CVE-2021-45451

High

Description

In Mbed TLS before 3.1.0, psa_aead_generate_nonce allows policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to an untrusted application.

SeverityHigh

CVSS7.5

Exploit probability—

Product

Arm Mbed Tls

PublishedDec 21, 2021

First seenDec 21, 2021

How to fix

Update

arm mbed_tls3.1.0 or later

Vendor advisories

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TALJHOYAYSUJTLN6BYGLO4YJGNZUY74W/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IL66WKJGXY5AXMTFE7QDMGL3RIBD6PX5/

Affected products

Product	Affected versions	Fixed in
arm mbed_tls	v < 3.1.0	3.1.0
fedoraproject fedora	36, 37	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.