MGASA-2022-0415

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2022-0415.html
Import Source
https://advisories.mageia.org/MGASA-2022-0415.json
JSON Data
https://api.test.osv.dev/v1/vulns/MGASA-2022-0415
Related
Published
2022-11-08T19:44:28Z
Modified
2022-11-08T18:44:07Z
Summary
Updated mbedtls packages fix security vulnerability
Details

An unauthenticated remote host could send an invalid ClientHello message in which the declared length of the cookie extends past the end of the message. A DTLS server with MBEDTLSSSLDTLSCLIENTPORT_REUSE enabled would read past the end of the message up to the declared length of the cookie. This could cause a buffer overread of up to 255 bytes on the heap in vulnerable DTLS servers, which may lead to a crash or to information disclosure via the cookie check function (CVE-2022-35409).

This issue has been patched, backporting a fix from upstream's 2.28.0 release.

References
Credits

Affected packages

Mageia:8 / mbedtls

Package

Name
mbedtls
Purl
pkg:rpm/mageia/mbedtls?distro=mageia-8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.16.12-1.1.mga8

Ecosystem specific 

{
    "section": "core"
}