Denial of Service Vulnerability in mbed TLS by ARM
CVE-2021-43666

7.5HIGH

Key Information:

Vendor

Arm
Status
Mbed Tls
Vendor
CVE Published:
24 March 2022

What is CVE-2021-43666?

A Denial of Service vulnerability in mbed TLS arises from the mbedtls_pkcs12_derivation function when inputs with a password length of zero are processed. This flaw can potentially make the system unresponsive, highlighting the need for robust input validation to prevent exploitation. The issue particularly affects mbed TLS versions up to 3.0.0, posing a risk to applications relying on this library for secure communications.

References

https://github.com/ARMmbed/mbedtls/issues/5136
https://lists.debian.org/debian-lts-announce/2022/12/msg0...
mailing-list

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.