GHSA-97vf-2gx4-2rfmHighCVSS 7.5
In Mbed TLS before 2.28.0 and 3.x before 3.1.0, psa_cipher_generate_iv and psa_cipher_encrypt...
🔗 CVE IDs covered (1)
📋 Description
In Mbed TLS before 2.28.0 and 3.x before 3.1.0, psa_cipher_generate_iv and psa_cipher_encrypt allow policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to an untrusted application.
🔗 References (9)
- https://nvd.nist.gov/vuln/detail/CVE-2021-45450
- https://github.com/ARMmbed/mbedtls/releases/tag/v2.28.0
- https://github.com/ARMmbed/mbedtls/releases/tag/v3.1.0
- https://security.gentoo.org/glsa/202301-08
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IL66WKJGXY5AXMTFE7QDMGL3RIBD6PX5
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TALJHOYAYSUJTLN6BYGLO4YJGNZUY74W
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IL66WKJGXY5AXMTFE7QDMGL3RIBD6PX5
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TALJHOYAYSUJTLN6BYGLO4YJGNZUY74W
- https://github.com/advisories/GHSA-97vf-2gx4-2rfm