CVE-2024-28755 - Vulnerability Details - OpenCVE

An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When an SSL context was reset with the mbedtls_ssl_session_reset() API, the maximum TLS version to be negotiated was not restored to the configured one. An attacker was able to prevent an Mbed TLS server from establishing any TLS 1.3 connection, potentially resulting in a Denial of Service or forced version downgrade from TLS 1.3 to TLS 1.2.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00127.

Key SSVC decision points have not yet been added.

Vendors	Products
Arm	Mbed Tls

Configuration 1 [-]

cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.6.0
https://github.com/hey3e
https://hey3e.github.io
https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/

History

Tue, 10 Jun 2025 01:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Arm Arm mbed Tls
CPEs		cpe:2.3:a:arm:mbed_tls::::::::
Vendors & Products		Arm Arm mbed Tls

Fri, 06 Sep 2024 21:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-326
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-04-03T00:00:00

Updated: 2024-09-06T19:25:20.346Z

Reserved: 2024-03-10T00:00:00

Link: CVE-2024-28755

Vulnrichment

Updated: 2024-08-02T00:56:58.123Z

NVD

Status : Analyzed

Published: 2024-04-03T03:15:10.140

Modified: 2025-06-10T00:41:15.783

Link: CVE-2024-28755

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-28755", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-09-06T19:25:20.346Z", "dateReserved": "2024-03-10T00:00:00", "datePublished": "2024-04-03T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-04-03T02:17:59.477891"}, "descriptions": [{"lang": "en", "value": "An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When an SSL context was reset with the mbedtls_ssl_session_reset() API, the maximum TLS version to be negotiated was not restored to the configured one. An attacker was able to prevent an Mbed TLS server from establishing any TLS 1.3 connection, potentially resulting in a Denial of Service or forced version downgrade from TLS 1.3 to TLS 1.2."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/"}, {"url": "https://hey3e.github.io"}, {"url": "https://github.com/hey3e"}, {"url": "https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.6.0"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:56:58.123Z"}, "title": "CVE Program Container", "references": [{"url": "https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/", "tags": ["x_transferred"]}, {"url": "https://hey3e.github.io", "tags": ["x_transferred"]}, {"url": "https://github.com/hey3e", "tags": ["x_transferred"]}, {"url": "https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.6.0", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-326", "lang": "en", "description": "CWE-326 Inadequate Encryption Strength"}]}], "affected": [{"vendor": "mbed", "product": "mbedtls", "cpes": ["cpe:2.3:a:mbed:mbedtls:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "3.6.0", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-08-29T15:04:39.775552Z", "id": "CVE-2024-28755", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-06T19:25:20.346Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/", "tags": ["x_transferred"]}, {"url": "https://hey3e.github.io", "tags": ["x_transferred"]}, {"url": "https://github.com/hey3e", "tags": ["x_transferred"]}, {"url": "https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.6.0", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:56:58.123Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-28755", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-29T15:04:39.775552Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:mbed:mbedtls:*:*:*:*:*:*:*:*"], "vendor": "mbed", "product": "mbedtls", "versions": [{"status": "affected", "version": "0", "lessThan": "3.6.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-326", "description": "CWE-326 Inadequate Encryption Strength"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-21T20:19:35.571Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/"}, {"url": "https://hey3e.github.io"}, {"url": "https://github.com/hey3e"}, {"url": "https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.6.0"}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When an SSL context was reset with the mbedtls_ssl_session_reset() API, the maximum TLS version to be negotiated was not restored to the configured one. An attacker was able to prevent an Mbed TLS server from establishing any TLS 1.3 connection, potentially resulting in a Denial of Service or forced version downgrade from TLS 1.3 to TLS 1.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-04-03T02:17:59.477891"}}}, "cveMetadata": {"cveId": "CVE-2024-28755", "state": "PUBLISHED", "dateUpdated": "2024-09-06T19:25:20.346Z", "dateReserved": "2024-03-10T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2024-04-03T00:00:00", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*", "matchCriteriaId": "EB2A3689-7273-4428-841D-54E11694CB71", "versionEndIncluding": "3.6.0", "versionStartIncluding": "3.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When an SSL context was reset with the mbedtls_ssl_session_reset() API, the maximum TLS version to be negotiated was not restored to the configured one. An attacker was able to prevent an Mbed TLS server from establishing any TLS 1.3 connection, potentially resulting in a Denial of Service or forced version downgrade from TLS 1.3 to TLS 1.2."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en Mbed TLS 3.5.x anterior a 3.6.0. Cuando se restableci\u00f3 un contexto SSL con la API mbedtls_ssl_session_reset(), la versi\u00f3n m\u00e1xima de TLS a negociar no se restaur\u00f3 a la configurada. Un atacante pudo evitar que un servidor Mbed TLS estableciera cualquier conexi\u00f3n TLS 1.3, lo que podr\u00eda provocar una denegaci\u00f3n de servicio o una degradaci\u00f3n forzada de la versi\u00f3n de TLS 1.3 a TLS 1.2."}], "id": "CVE-2024-28755", "lastModified": "2025-06-10T00:41:15.783", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-04-03T03:15:10.140", "references": [{"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.6.0"}, {"source": "cve@mitre.org", "tags": ["Not Applicable"], "url": "https://github.com/hey3e"}, {"source": "cve@mitre.org", "tags": ["Not Applicable"], "url": "https://hey3e.github.io"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.6.0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Not Applicable"], "url": "https://github.com/hey3e"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Not Applicable"], "url": "https://hey3e.github.io"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-326"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}