ID de Prueba:	1.3.6.1.4.1.25623.1.1.10.2022.0415
Categoría:	Mageia Linux Local Security Checks
Título:	Mageia: Security Advisory (MGASA-2022-0415)
Resumen:	The remote host is missing an update for the 'mbedtls' package(s) announced via the MGASA-2022-0415 advisory.
Descripción:	Summary: The remote host is missing an update for the 'mbedtls' package(s) announced via the MGASA-2022-0415 advisory. Vulnerability Insight: An unauthenticated remote host could send an invalid ClientHello message in which the declared length of the cookie extends past the end of the message. A DTLS server with MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE enabled would read past the end of the message up to the declared length of the cookie. This could cause a buffer overread of up to 255 bytes on the heap in vulnerable DTLS servers, which may lead to a crash or to information disclosure via the cookie check function (CVE-2022-35409). This issue has been patched, backporting a fix from upstream's 2.28.0 release. Affected Software/OS: 'mbedtls' package(s) on Mageia 8. Solution: Please install the updated package(s). CVSS Score: 9.4 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:N/A:C
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2022-35409 [debian-lts-announce] 20221225 [SECURITY] [DLA 3249-1] mbedtls security update https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html https://github.com/Mbed-TLS/mbedtls/releases https://mbed-tls.readthedocs.io/en/latest/security-advisories/advisories/mbedtls-security-advisory-2022-07.html
Copyright	Copyright (C) 2022 Greenbone AG

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.