David Wong

The issue is related to a local synchronization problem during RSA decryption in Mbed TLS, allowing a local unprivileged attacker to recover the plaintext of RSA decryption. This affects RSA-without-(EC)DH(E) cipher suites. The vulnerability can be exploited to gain access to protected information.

The issue concerns the encryption of passwords entered after executing the First Time User Wizards when a central credential store is not configured. This allows local users to obtain sensitive information.