CVE-2024-45158
published 2024-09-05CVE-2024-45158: An issue was discovered in Mbed TLS 3.6 before 3.6.1. A stack buffer overflow in mbedtls_ecdsa_der_to_raw() and mbedtls_ecdsa_raw_to_der() can occur when the…
PriorityP353critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.68%
47.6th percentile
An issue was discovered in Mbed TLS 3.6 before 3.6.1. A stack buffer overflow in mbedtls_ecdsa_der_to_raw() and mbedtls_ecdsa_raw_to_der() can occur when the bits parameter is larger than the largest supported curve. In some configurations with PSA disabled, all values of bits are affected. (This never happens in internal library calls, but can affect applications that call these functions directly.)
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | mbedtls | — | — |
| mbed | mbedtls | >= 0 < 3.6.1-r0 | 3.6.1-r0 |
| mbed | mbedtls | >= 0 < 3.6.1-r0 | 3.6.1-r0 |
| mbed | mbedtls | >= 0 < 3.6.1-r0 | 3.6.1-r0 |
| mbed | mbedtls | >= 0 < 3.6.1-r0 | 3.6.1-r0 |
| trustedfirmware | mbed_tls | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vendor_debian9.8LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2024-45158: An issue was discovered in Mbed TLS 3
osv·2024-09-05·CVSS 9.8
CVE-2024-45158 [CRITICAL] CVE-2024-45158: An issue was discovered in Mbed TLS 3
An issue was discovered in Mbed TLS 3.6 before 3.6.1. A stack buffer overflow in mbedtls_ecdsa_der_to_raw() and mbedtls_ecdsa_raw_to_der() can occur when the bits parameter is larger than the largest supported curve. In some configurations with PSA disabled, all values of bits are affected. (This never happens in internal library calls, but can affect applications that call these functions directly.)
GHSA
GHSA-hw5v-7r63-g2h6: An issue was discovered in Mbed TLS 3
ghsa_unreviewed·2024-09-05
CVE-2024-45158 [CRITICAL] CWE-121 GHSA-hw5v-7r63-g2h6: An issue was discovered in Mbed TLS 3
An issue was discovered in Mbed TLS 3.6 before 3.6.1. A stack buffer overflow in mbedtls_ecdsa_der_to_raw() and mbedtls_ecdsa_raw_to_der() can occur when the bits parameter is larger than the largest supported curve. In some configurations with PSA disabled, all values of bits are affected. (This never happens in internal library calls, but can affect applications that call these functions directly.)
Debian
CVE-2024-45158: mbedtls - An issue was discovered in Mbed TLS 3.6 before 3.6.1. A stack buffer overflow in...
vendor_debian·2024·CVSS 9.8
CVE-2024-45158 [CRITICAL] CVE-2024-45158: mbedtls - An issue was discovered in Mbed TLS 3.6 before 3.6.1. A stack buffer overflow in...
An issue was discovered in Mbed TLS 3.6 before 3.6.1. A stack buffer overflow in mbedtls_ecdsa_der_to_raw() and mbedtls_ecdsa_raw_to_der() can occur when the bits parameter is larger than the largest supported curve. In some configurations with PSA disabled, all values of bits are affected. (This never happens in internal library calls, but can affect applications that call these functions directly.)
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-09-05
Published