CVE-2024-23775

Name of the Vulnerable Software and Affected Versions Mbed TLS versions 2.x through 2.28.6 Mbed TLS versions 3.x through 3.5.1

Description The issue is related to an integer overflow vulnerability in the mbedtls x509 set extension() function, which can be exploited by attackers to cause a denial of service (DoS). This vulnerability allows a remote attacker to trigger the DoS.

Recommendations For Mbed TLS versions 2.x through 2.28.6, update to version 2.28.7 or later. For Mbed TLS versions 3.x through 3.5.1, update to version 3.5.2 or later. As a temporary workaround, consider restricting the use of the mbedtls x509 set extension() function until a patch is available.