CVE-2021-45451
HIGHMbed TLS < 3.1.0 - Policy Bypass and Oracle-Based Decryption via psa_aead_generate_nonce
Title source: llmDescription
In Mbed TLS before 3.1.0, psa_aead_generate_nonce allows policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to an untrusted application.
References (3)
Core 3
Core References
Mailing List, Third Party Advisory vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TALJHOYAYSUJTLN6BYGLO4YJGNZUY74W/
Mailing List, Third Party Advisory vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IL66WKJGXY5AXMTFE7QDMGL3RIBD6PX5/
Patch, Release Notes, Third Party Advisory
https://github.com/ARMmbed/mbedtls/releases/tag/v3.1.0
Scores
CVSS v3
7.5
EPSS
0.0014
EPSS Percentile
34.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-327
Status
published
Products (3)
arm/mbed_tls
< 3.1.0
fedoraproject/fedora
36
fedoraproject/fedora
37
Published
Dec 21, 2021
Tracked Since
Feb 18, 2026