ALT-PU-2015-2061-2

Package update mbedtls in branch sisyphus

Version2.2.0-alt1

Published2026-06-07

Max severityHIGH

Severity:

Closed issues (4)

MEDIUM6.2

Уязвимость реализации протоколов TLS и SSL программного обеспечения Mbed TLS, связанная с локальной синхронизацией при расшифровке RSA, позволяющая нарушителю получить доступ к защищаемой информации

Published: 2019-01-14Modified: 2021-03-22

CVSS 3.xMEDIUM 6.2

CVSS:3.x/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS 2.0MEDIUM 4.9

CVSS:2.0/AV:L/AC:L/Au:N/C:C/I:N/A:N

References

MEDIUM4.7

Arm Mbed TLS before 2.14.1, before 2.7.8, and before 2.1.17 allows a local unprivileged attacker to recover the plaintext of RSA decryption, which is used in RSA-without-(EC)DH(E) cipher suites.

Published: 2018-12-05Modified: 2026-06-05

CVSS 2.0LOW 1.9

CVSS:2.0/AV:L/AC:M/Au:N/C:P/I:N/A:N

CVSS 3.xMEDIUM 4.7

CVSS:3.x/CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

References

HIGH7.5

ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_key_exchange() that could cause a crash on invalid input.

Published: 2018-04-10Modified: 2026-06-05

CVSS 2.0MEDIUM 5.0

CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

HIGH7.5

ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_psk_hint() that could cause a crash on invalid input.

Published: 2018-04-10Modified: 2026-06-05

CVSS 2.0MEDIUM 5.0

CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References