Test Kennung:	1.3.6.1.4.1.25623.1.1.10.2022.0415
Kategorie:	Mageia Linux Local Security Checks
Titel:	Mageia: Security Advisory (MGASA-2022-0415)
Zusammenfassung:	The remote host is missing an update for the 'mbedtls' package(s) announced via the MGASA-2022-0415 advisory.
Beschreibung:	Summary: The remote host is missing an update for the 'mbedtls' package(s) announced via the MGASA-2022-0415 advisory. Vulnerability Insight: An unauthenticated remote host could send an invalid ClientHello message in which the declared length of the cookie extends past the end of the message. A DTLS server with MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE enabled would read past the end of the message up to the declared length of the cookie. This could cause a buffer overread of up to 255 bytes on the heap in vulnerable DTLS servers, which may lead to a crash or to information disclosure via the cookie check function (CVE-2022-35409). This issue has been patched, backporting a fix from upstream's 2.28.0 release. Affected Software/OS: 'mbedtls' package(s) on Mageia 8. Solution: Please install the updated package(s). CVSS Score: 9.4 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:N/A:C
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2022-35409 [debian-lts-announce] 20221225 [SECURITY] [DLA 3249-1] mbedtls security update https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html https://github.com/Mbed-TLS/mbedtls/releases https://mbed-tls.readthedocs.io/en/latest/security-advisories/advisories/mbedtls-security-advisory-2022-07.html
Copyright	Copyright (C) 2022 Greenbone AG

Dies ist nur einer von 145615 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.