CVE-2024-28755: Weak Encryption
An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When an SSL context was reset with the mbedtlssslsessionreset() API, the maximum TLS version to be negotiated was not restored to the configured one. An attacker was able to prevent an Mbed TLS server from establishing any TLS 1.3 connection, potentially resulting in a Denial of Service or forced version downgrade from TLS 1.3 to TLS 1.2.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-28755?
CVE-2024-28755 has a high severity as it affects the establishment of TLS 1.3 connections in Mbed TLS.
How do I fix CVE-2024-28755?
To fix CVE-2024-28755, upgrade Mbed TLS to version 3.6.0 or later.
Which versions of Mbed TLS are affected by CVE-2024-28755?
CVE-2024-28755 affects Mbed TLS versions from 3.5.x up to, but not including, 3.6.0.
What impact does CVE-2024-28755 have on TLS connections?
CVE-2024-28755 prevents Mbed TLS servers from establishing any TLS 1.3 connections.
Is CVE-2024-28755 a remote vulnerability?
Yes, CVE-2024-28755 can potentially be exploited by remote attackers.