CVE-2021-45450 — Use of a Broken or Risky Cryptographic Algorithm in ARM Mbed TLS

CWE-327 — Use of a Broken or Risky Cryptographic Algorithm5 documents5 sources
Severity
7.5HIGHNVD
EPSS
0.1%
top 78.21%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
ARM Mbed TLSFedoraproject Fedora
Timeline
PublishedDec 21
Latest updateDec 22

Description

In Mbed TLS before 2.28.0 and 3.x before 3.1.0, psa_cipher_generate_iv and psa_cipher_encrypt allow policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to an untrusted application.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

▶NVDarm/mbed_tls2.22.0 — 2.28.0+1

Also affects: Fedora 36, 37

🔴Vulnerability Details

3
GHSA
GHSA-97vf-2gx4-2rfm: In Mbed TLS before 2↗2021-12-22
▶
OSV
CVE-2021-45450: In Mbed TLS before 2↗2021-12-21
▶
CVEList
CVE-2021-45450: In Mbed TLS before 2↗2021-12-21
▶

📋Vendor Advisories

1
Debian
CVE-2021-45450: mbedtls - In Mbed TLS before 2.28.0 and 3.x before 3.1.0, psa_cipher_generate_iv and psa_c...↗2021
▶
CVE-2021-45450 — ARM Mbed TLS vulnerability | cvebase