Source: mbedtls X-Debbugs-CC: t...@security.debian.org Severity: important Tags: security
Hi, The following vulnerability was published for mbedtls. CVE-2024-28755[0]: | An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When an SSL | context was reset with the mbedtls_ssl_session_reset() API, the | maximum TLS version to be negotiated was not restored to the | configured one. An attacker was able to prevent an Mbed TLS server | from establishing any TLS 1.3 connection, potentially resulting in a | Denial of Service or forced version downgrade from TLS 1.3 to TLS | 1.2. https://github.com/Mbed-TLS/mbedtls/issues/8654 If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2024-28755 https://www.cve.org/CVERecord?id=CVE-2024-28755 Please adjust the affected versions in the BTS as needed.
