CVE-2021-43666 — Improper Handling of Length Parameter Inconsistency in ARM Mbed TLS

CWE-130 — Improper Handling of Length Parameter Inconsistency7 documents7 sources
Severity
7.5HIGHNVD
EPSS
0.7%
top 27.65%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Mbed MbedtlsARM Mbed TLSDebian Linux
Timeline
PublishedMar 24
Latest updateFeb 15

Description

A Denial of Service vulnerability exists in mbed TLS 3.0.0 and earlier in the mbedtls_pkcs12_derivation function when an input password's length is 0.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶Debianmbed/mbedtls< 2.16.9-0.1+deb11u1+3
▶NVDarm/mbed_tls3.0.0

Also affects: Debian Linux 10.0

🔴Vulnerability Details

3
GHSA
GHSA-cgwh-hfr7-38m2: A Denial of Service vulnerability exists in mbed TLS 3↗2022-03-25
▶
CVEList
CVE-2021-43666: A Denial of Service vulnerability exists in mbed TLS 3↗2022-03-24
▶
OSV
CVE-2021-43666: A Denial of Service vulnerability exists in mbed TLS 3↗2022-03-24
▶

📋Vendor Advisories

3
CISA ICS
Siemens SCALANCE XCM-/XRM-300↗2024-02-15
▶
Microsoft
A Denial of Service vulnerability exists in mbed TLS 3.0.0 and earlier in the mbedtls_pkcs12_derivation function when an input password's length is 0.↗2022-03-08
▶
Debian
CVE-2021-43666: mbedtls - A Denial of Service vulnerability exists in mbed TLS 3.0.0 and earlier in the mb...↗2021
▶
CVE-2021-43666 — ARM Mbed TLS vulnerability | cvebase