CVE-2023-24609

Katalog CVE

CVSS 7.5 · High EPSS 0,73%

Kerentanan Integer Overflow or Wraparound pada matrixssl, rambus tls toolkit. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Matrix SSL 4.x through 4.6.0 and Rambus TLS Toolkit have a length-subtraction integer overflow for Client Hello Pre-Shared Key extension parsing in the TLS 1.3 server. An attacked device calculates an SHA-2 hash over at least 65 KB (in RAM). With a large number of crafted TLS messages, the CPU becomes heavily loaded. This occurs in tls13VerifyBinder and tls13TranscriptHashUpdate.

Rincian

Terbit di NVD

22 Desember 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-190: Integer Overflow or Wraparound

EPSS (30 hari)

0,73% peluang dieksploitasi; lebih tinggi dari 53,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.telekom.com/en/company/data-privacy-and-security/news/advisories-504842 exploit · advisory pihak ketiga
• https://www.rambus.com/security/software-protocols/tls-toolkit/ product