CVE-2021-45450

Katalog CVE

CVSS 7.5 · High EPSS 1,2%

Kerentanan Use of a Broken or Risky Cryptographic Algorithm pada trustedfirmware mbed tls, fedoraproject fedora. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

In Mbed TLS before 2.28.0 and 3.x before 3.1.0, psa_cipher_generate_iv and psa_cipher_encrypt allow policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to an untrusted application.

Rincian

Terbit di NVD

21 Desember 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-327: Use of a Broken or Risky Cryptographic Algorithm

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 67,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ARMmbed/mbedtls/releases/tag/v2.28.0 release notes · advisory pihak ketiga
• https://github.com/ARMmbed/mbedtls/releases/tag/v3.1.0 release notes · advisory pihak ketiga
• https://security.gentoo.org/glsa/202301-08 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IL66WKJGXY5AX... mailing list
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TALJHOYAYSUJT... mailing list