CVE-2022-46393

Katalog CVE

CVSS 9.8 · Critical EPSS 1,2%

Kerentanan Out-of-bounds Read pada arm mbed tls, trustedfirmware mbed tls +1 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. There is a potential heap-based buffer overflow and heap-based buffer over-read in DTLS if MBEDTLS_SSL_DTLS_CONNECTION_ID is enabled and MBEDTLS_SSL_CID_IN_LEN_MAX > 2 * MBEDTLS_SSL_CID_OUT_LEN_MAX.

Rincian

Terbit di NVD

15 Desember 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read
CWE-787: Out-of-bounds Write

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 67,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/ advisory vendor
• https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.2 release notes · advisory pihak ketiga
• https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.3.0 release notes · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4BR7ZCVKLPGCO...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XMKJ5IMJEPXY...