Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ubuntucveUbuntu.comUB:CVE-2022-35409
HistoryJul 15, 2022 - 12:00 a.m.

CVE-2022-35409

2022-07-1500:00:00
ubuntu.com
ubuntu.com
18
mbed tls
buffer over-read
dtls server
information disclosure
unix

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

EPSS

0.001

Percentile

48.7%

JSON

An issue was discovered in Mbed TLS before 2.28.1 and 3.x before 3.2.0. In
some configurations, an unauthenticated attacker can send an invalid
ClientHello message to a DTLS server that causes a heap-based buffer
over-read of up to 255 bytes. This can cause a server crash or possibly
information disclosure based on error responses. Affected configurations
have MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE enabled and
MBEDTLS_SSL_IN_CONTENT_LEN less than a threshold that depends on the
configuration: 258 bytes if using mbedtls_ssl_cookie_check, and possibly up
to 571 bytes with a custom cookie check function.

OSVersionArchitecturePackageVersionFilename
ubuntu22.04noarchmbedtls< anyUNKNOWN
ubuntu24.04noarchmbedtls< anyUNKNOWN

References

Related

debiancve 1
alpinelinux 1
cve 1
mageia 1
prion 1
cvelist 1
nvd 1
openvas 2
osv 2
veracode 1
nessus 3
gentoo 1
debian 1
debiancve
debiancve
CVE-2022-35409
2022-07-15 14:15:09
alpinelinux
alpinelinux
CVE-2022-35409
2022-07-15 14:15:09
cve
cve
CVE-2022-35409
2022-07-15 14:15:09
mageia
mageia
Updated mbedtls packages fix security vulnerability
2022-11-08 22:44:28
prion
prion
Heap overflow
2022-07-15 14:15:00
cvelist
cvelist
CVE-2022-35409
2022-07-15 00:00:00
nvd
nvd
CVE-2022-35409
2022-07-15 14:15:09
openvas
openvas
Mageia: Security Advisory (MGASA-2022-0415)
2022-11-09 00:00:00
Debian: Security Advisory (DLA-3249-1)
2022-12-26 00:00:00
osv
osv
CVE-2022-35409
2022-07-15 14:15:09
mbedtls - security update
2022-12-26 00:00:00
veracode
veracode
Denial Of Service (DoS)
2022-07-18 10:58:03
nessus
nessus
openSUSE 15 Security Update : mbedtls (openSUSE-SU-2022:10247-1)
2022-12-23 00:00:00
GLSA-202301-08 : Mbed TLS: Multiple Vulnerabilities
2023-01-11 00:00:00
Debian DLA-3249-1 : mbedtls - LTS security update
2022-12-26 00:00:00
gentoo
gentoo
Mbed TLS: Multiple Vulnerabilities
2023-01-11 00:00:00
debian
debian
[SECURITY] [DLA 3249-1] mbedtls security update
2022-12-25 23:33:58

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

EPSS

0.001

Percentile

48.7%

JSON
Related for UB:CVE-2022-35409
debiancve1alpinelinux1cve1mageia1prion1cvelist1nvd1openvas2osv2veracode1nessus3gentoo1debian1