rpm package
opensuse/mbedtls&distro=openSUSE Leap 16.0
pkg:rpm/opensuse/mbedtls&distro=openSUSE%20Leap%2016.0
Vulnerabilities (15)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-25835 | Hig | 7.7 | < 3.6.6-bp160.1.1 | 3.6.6-bp160.1.1 | Apr 1, 2026 | Mbed TLS before 3.6.6 and TF-PSA-Crypto before 1.1.0 misuse seeds in a Pseudo-Random Number Generator (PRNG). | |
| CVE-2026-25833 | Hig | 7.5 | < 3.6.6-bp160.1.1 | 3.6.6-bp160.1.1 | Apr 1, 2026 | Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer overflow in the x509_inet_pton_ipv6() function | |
| CVE-2026-25834 | Med | 6.5 | < 3.6.6-bp160.1.1 | 3.6.6-bp160.1.1 | Apr 1, 2026 | Mbed TLS v3.3.0 up to 3.6.5 and 4.0.0 allows Algorithm Downgrade. | |
| CVE-2025-59438 | Med | 5.3 | < 3.6.6-bp160.1.1 | 3.6.6-bp160.1.1 | Oct 21, 2025 | Mbed TLS through 3.6.4 has an Observable Timing Discrepancy. | |
| CVE-2025-54764 | Med | 6.2 | < 3.6.6-bp160.1.1 | 3.6.6-bp160.1.1 | Oct 20, 2025 | Mbed TLS before 3.6.5 allows a local timing attack against certain RSA operations, and direct calls to mbedtls_mpi_mod_inv or mbedtls_mpi_gcd. | |
| CVE-2025-49087 | Med | 4.0 | < 3.6.6-bp160.1.1 | 3.6.6-bp160.1.1 | Jul 20, 2025 | In Mbed TLS 3.6.1 through 3.6.3 before 3.6.4, a timing discrepancy in block cipher padding removal allows an attacker to recover the plaintext when PKCS#7 padding mode is used. | |
| CVE-2025-47917 | Hig | 8.9 | < 3.6.6-bp160.1.1 | 3.6.6-bp160.1.1 | Jul 20, 2025 | Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation. The function mbedtls_x509_string_to_names() takes a head argument that is documented as an output argument. The documentation does not sugg | |
| CVE-2025-48965 | Med | 4.0 | < 3.6.6-bp160.1.1 | 3.6.6-bp160.1.1 | Jul 20, 2025 | Mbed TLS before 3.6.4 has a NULL pointer dereference because mbedtls_asn1_store_named_data can trigger conflicting data with val.p of NULL but val.len greater than zero. | |
| CVE-2025-52497 | Med | 4.8 | < 3.6.6-bp160.1.1 | 3.6.6-bp160.1.1 | Jul 4, 2025 | Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer underflow, in mbedtls_pem_read_buffer and two mbedtls_pk_parse functions, via untrusted PEM input. | |
| CVE-2025-52496 | Hig | 7.8 | < 3.6.6-bp160.1.1 | 3.6.6-bp160.1.1 | Jul 4, 2025 | Mbed TLS before 3.6.4 has a race condition in AESNI detection if certain compiler optimizations occur. An attacker may be able to extract an AES key from a multithreaded program, or perform a GCM forgery. | |
| CVE-2025-49601 | Med | 4.8 | < 3.6.6-bp160.1.1 | 3.6.6-bp160.1.1 | Jul 4, 2025 | In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_import_public_key does not check that the input buffer is at least 4 bytes before reading a 32-bit field, allowing a possible out-of-bounds read on truncated input. Specifically, an out-of-bounds read in mbedtls_lms_import_public_key all | |
| CVE-2025-49600 | Med | 4.9 | < 3.6.6-bp160.1.1 | 3.6.6-bp160.1.1 | Jul 4, 2025 | In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_verify may accept invalid signatures if hash computation fails and internal errors go unchecked, enabling LMS (Leighton-Micali Signature) forgery in a fault scenario. Specifically, unchecked return values in mbedtls_lms_verify allow an a | |
| CVE-2025-27810 | Med | 5.4 | < 3.6.6-bp160.1.1 | 3.6.6-bp160.1.1 | Mar 25, 2025 | Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory to compose the TLS Finished message, potentially leading to authentication bypasses such as replays. | |
| CVE-2025-27809 | Med | 5.4 | < 3.6.6-bp160.1.1 | 3.6.6-bp160.1.1 | Mar 25, 2025 | Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client application calls mbedtls_ssl_set_hostname. | |
| CVE-2024-49195 | Cri | 9.8 | < 3.6.6-bp160.1.1 | 3.6.6-bp160.1.1 | Oct 15, 2024 | Mbed TLS 3.5.x through 3.6.x before 3.6.2 has a buffer underrun in pkwrite when writing an opaque key pair |
- affected < 3.6.6-bp160.1.1fixed 3.6.6-bp160.1.1
Mbed TLS before 3.6.6 and TF-PSA-Crypto before 1.1.0 misuse seeds in a Pseudo-Random Number Generator (PRNG).
- affected < 3.6.6-bp160.1.1fixed 3.6.6-bp160.1.1
Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer overflow in the x509_inet_pton_ipv6() function
- affected < 3.6.6-bp160.1.1fixed 3.6.6-bp160.1.1
Mbed TLS v3.3.0 up to 3.6.5 and 4.0.0 allows Algorithm Downgrade.
- affected < 3.6.6-bp160.1.1fixed 3.6.6-bp160.1.1
Mbed TLS through 3.6.4 has an Observable Timing Discrepancy.
- affected < 3.6.6-bp160.1.1fixed 3.6.6-bp160.1.1
Mbed TLS before 3.6.5 allows a local timing attack against certain RSA operations, and direct calls to mbedtls_mpi_mod_inv or mbedtls_mpi_gcd.
- affected < 3.6.6-bp160.1.1fixed 3.6.6-bp160.1.1
In Mbed TLS 3.6.1 through 3.6.3 before 3.6.4, a timing discrepancy in block cipher padding removal allows an attacker to recover the plaintext when PKCS#7 padding mode is used.
- affected < 3.6.6-bp160.1.1fixed 3.6.6-bp160.1.1
Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation. The function mbedtls_x509_string_to_names() takes a head argument that is documented as an output argument. The documentation does not sugg
- affected < 3.6.6-bp160.1.1fixed 3.6.6-bp160.1.1
Mbed TLS before 3.6.4 has a NULL pointer dereference because mbedtls_asn1_store_named_data can trigger conflicting data with val.p of NULL but val.len greater than zero.
- affected < 3.6.6-bp160.1.1fixed 3.6.6-bp160.1.1
Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer underflow, in mbedtls_pem_read_buffer and two mbedtls_pk_parse functions, via untrusted PEM input.
- affected < 3.6.6-bp160.1.1fixed 3.6.6-bp160.1.1
Mbed TLS before 3.6.4 has a race condition in AESNI detection if certain compiler optimizations occur. An attacker may be able to extract an AES key from a multithreaded program, or perform a GCM forgery.
- affected < 3.6.6-bp160.1.1fixed 3.6.6-bp160.1.1
In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_import_public_key does not check that the input buffer is at least 4 bytes before reading a 32-bit field, allowing a possible out-of-bounds read on truncated input. Specifically, an out-of-bounds read in mbedtls_lms_import_public_key all
- affected < 3.6.6-bp160.1.1fixed 3.6.6-bp160.1.1
In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_verify may accept invalid signatures if hash computation fails and internal errors go unchecked, enabling LMS (Leighton-Micali Signature) forgery in a fault scenario. Specifically, unchecked return values in mbedtls_lms_verify allow an a
- affected < 3.6.6-bp160.1.1fixed 3.6.6-bp160.1.1
Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory to compose the TLS Finished message, potentially leading to authentication bypasses such as replays.
- affected < 3.6.6-bp160.1.1fixed 3.6.6-bp160.1.1
Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client application calls mbedtls_ssl_set_hostname.
- affected < 3.6.6-bp160.1.1fixed 3.6.6-bp160.1.1
Mbed TLS 3.5.x through 3.6.x before 3.6.2 has a buffer underrun in pkwrite when writing an opaque key pair