| Bug ID | 1201581 |
|---|---|
| Summary | VUL-0: CVE-2022-35409: mbedtls: Buffer overread in DTLS ClientHello parsing |
| Classification | openSUSE |
| Product | openSUSE Distribution |
| Version | Leap 15.4 |
| Hardware | Other |
| URL | https://smash.suse.de/issue/337399/ |
| OS | Other |
| Status | NEW |
| Severity | Minor |
| Priority | P5 - None |
| Component | Security |
| Assignee | mpluskal@suse.com |
| Reporter | cathy.hu@suse.com |
| QA Contact | security-team@suse.de |
| Found By | Security Response Team |
| Blocker | --- |
CVE-2022-35409 An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.2.0. In some configurations, an unauthenticated attacker can send an invalid ClientHello message to a DTLS server that causes a heap-based buffer over-read of up to 255 bytes. This can cause a server crash or possibly information disclosure based on error responses. Affected configurations have MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE enabled and MBEDTLS_SSL_IN_CONTENT_LEN less than a threshold that depends on the configuration: 258 bytes if using mbedtls_ssl_cookie_check, and possibly up to 571 bytes with a custom cookie check function. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-35409 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35409 https://github.com/Mbed-TLS/mbedtls/releases https://mbed-tls.readthedocs.io/en/latest/security-advisories/advisories/mbedtls-security-advisory-2022-07.html