CVE-2024-28836

{"id": "CVE-2024-28836", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "published": "2024-04-03T03:15:10.350", "references": [{"url": "https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.6.0", "tags": ["Release Notes"], "source": "[email protected]"}, {"url": "https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.6.0", "tags": ["Release Notes"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-835"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When negotiating the TLS version on the server side, it can fall back to the TLS 1.2 implementation of the protocol if it is disabled. If the TLS 1.2 implementation was disabled at build time, a TLS 1.2 client could put a TLS 1.3-only server into an infinite loop processing a TLS 1.2 ClientHello, resulting in a denial of service. If the TLS 1.2 implementation was disabled at runtime, a TLS 1.2 client can successfully establish a TLS 1.2 connection with the server."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en Mbed TLS 3.5.x anterior a 3.6.0. Al negociar la versi\u00f3n TLS en el lado del servidor, puede recurrir a la implementaci\u00f3n TLS 1.2 del protocolo si est\u00e1 deshabilitada. Si la implementaci\u00f3n de TLS 1.2 se deshabilit\u00f3 en el momento de la compilaci\u00f3n, un cliente TLS 1.2 podr\u00eda colocar un servidor exclusivo de TLS 1.3 en un bucle infinito procesando un ClientHello de TLS 1.2, lo que resultar\u00eda en una denegaci\u00f3n de servicio. Si la implementaci\u00f3n de TLS 1.2 se deshabilit\u00f3 en tiempo de ejecuci\u00f3n, un cliente TLS 1.2 puede establecer exitosamente una conexi\u00f3n TLS 1.2 con el servidor."}], "lastModified": "2025-06-27T17:46:46.613", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E6F3DA60-78C6-4563-8944-8BF3BE5934C0", "versionEndExcluding": "3.6.0", "versionStartIncluding": "3.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}