ALPINE-CVE-2024-45159

🗓️ 05 Sep 2024 19:15:13Reported by GoogleType

osv🔗 osv.dev👁 1 Views

In Mbed TLS before 3.6.1, TLS 1.3 optional client authentication could misverify key usage, allowing non-client certs for client auth.

Reporter	Title	Published	Views	Family All 22
AlpineLinux	CVE-2024-45159	5 Sep 202400:00	–	alpinelinux
Circl	CVE-2024-45159	5 Sep 202422:13	–	circl
CNNVD	Mbed TLS 安全漏洞	5 Sep 202400:00	–	cnnvd
CVE	CVE-2024-45159	5 Sep 202400:00	–	cve
Cvelist	CVE-2024-45159	5 Sep 202400:00	–	cvelist
Debian CVE	CVE-2024-45159	5 Sep 202400:00	–	debiancve
EUVD	EUVD-2024-41339	3 Oct 202520:07	–	euvd
Tenable Nessus	CBL Mariner 2.0 Security Update: hvloader (CVE-2024-45159)	28 Nov 202400:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2024-45159	15 Aug 202500:00	–	nessus
Microsoft CVE	An issue was discovered in Mbed TLS 3.x before 3.6.1. With TLS 1.3, when a server enables optional authentication of the client, if the client-provided certificate does not have appropriate values in if keyUsage or extKeyUsage extensions, then the return value of mbedtls_ssl_get_verify_result() would incorrectly have the MBEDTLS_X509_BADCERT_KEY_USAGE and MBEDTLS_X509_BADCERT_KEY_USAGE bits clear. As a result, an attacker that had a certificate valid for uses other than TLS client authentication would nonetheless be able to use it for TLS client authentication. Only TLS 1.3 servers were affected, and only with optional authentication (with required authentication, the handshake would be aborted with a fatal alert).	28 Nov 202408:00	–	mscve