CVE-2024-45157

Medium

An issue was discovered in Mbed TLS before 2.28.9 and 3.x before 3.6.1, in which the user-selected algorithm is not used. Unlike previously…

mitre·NVD-CWE-noinfo·Published 2024-09-05

CVSS

5.1

EPSS

0.00

KEV

Exploits

cve.orgen

338 chars

An issue was discovered in Mbed TLS before 2.28.9 and 3.x before 3.6.1, in which the user-selected algorithm is not used. Unlike previously documented, enabling MBEDTLS_PSA_HMAC_DRBG_MD_TYPE does not cause the PSA subsystem to use HMAC_DRBG: it uses HMAC_DRBG only when MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG and MBEDTLS_CTR_DRBG_C are disabled.

NVDen

338 chars

NVDes

412 chars

Se descubrió un problema en Mbed TLS anterior a la versión 2.28.9 y en la versión 3.x anterior a la 3.6.1, en el que no se utiliza el algoritmo seleccionado por el usuario. A diferencia de lo documentado anteriormente, habilitar MBEDTLS_PSA_HMAC_DRBG_MD_TYPE no hace que el subsistema PSA utilice HMAC_DRBG: utiliza HMAC_DRBG solo cuando MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG y MBEDTLS_CTR_DRBG_C están deshabilitados.

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
3.1	Primary	cve.org	5.1	—	—	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
3.1	Primary	NVD	5.1	1.4	3.6	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
3.1	Primary	cve.org	5.1	—	—	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
3.1	Secondary	NVD	5.1	1.4	3.6	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N