https://bugzilla.suse.com/show_bug.cgi?id=1201581 Bug ID: 1201581 Summary: VUL-0: CVE-2022-35409: mbedtls: Buffer overread in DTLS ClientHello parsing Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/337399/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: mpluskal@suse.com Reporter: cathy.hu@suse.com QA Contact: security-team@suse.de Found By: Security Response Team Blocker: --- CVE-2022-35409 An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.2.0. In some configurations, an unauthenticated attacker can send an invalid ClientHello message to a DTLS server that causes a heap-based buffer over-read of up to 255 bytes. This can cause a server crash or possibly information disclosure based on error responses. Affected configurations have MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE enabled and MBEDTLS_SSL_IN_CONTENT_LEN less than a threshold that depends on the configuration: 258 bytes if using mbedtls_ssl_cookie_check, and possibly up to 571 bytes with a custom cookie check function. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-35409 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35409 https://github.com/Mbed-TLS/mbedtls/releases https://mbed-tls.readthedocs.io/en/latest/security-advisories/advisories/mbe... -- You are receiving this mail because: You are on the CC list for the bug.