CVE-2021-45450
HIGHMbed TLS < 2.28.0 and 3.x < 3.1.0 - Policy Bypass via PSA Cipher IV Generation
Title source: llmDescription
In Mbed TLS before 2.28.0 and 3.x before 3.1.0, psa_cipher_generate_iv and psa_cipher_encrypt allow policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to an untrusted application.
References (5)
Core 5
Core References
Mailing List vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TALJHOYAYSUJTLN6BYGLO4YJGNZUY74W/
Mailing List vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IL66WKJGXY5AXMTFE7QDMGL3RIBD6PX5/
Third Party Advisory vendor-advisory
https://security.gentoo.org/glsa/202301-08
Release Notes, Third Party Advisory
https://github.com/ARMmbed/mbedtls/releases/tag/v2.28.0
Release Notes, Third Party Advisory
https://github.com/ARMmbed/mbedtls/releases/tag/v3.1.0
Scores
CVSS v3
7.5
EPSS
0.0009
EPSS Percentile
25.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-327
Status
published
Products (4)
arm/mbed_tls
3.0.0
arm/mbed_tls
2.22.0 - 2.28.0
fedoraproject/fedora
36
fedoraproject/fedora
37
Published
Dec 21, 2021
Tracked Since
Feb 18, 2026