Astra Linux - уязвимость в mbedtls

An issue was discovered in Mbed TLS before 2.24.0 and before 2.16.8 LTS and before 2.7.17 LTS. There is missing zeroization of plaintext buffers in mbedtlssslread to erase unused application data from memory...

An issue was discovered in Mbed TLS before 2.24.0 (and before 2.16.8 LTS and before 2.7.17 LTS). There is missing zeroization of plaintext buffers in mbedtls_ssl_read to erase unused application data from memory.

...

DEBIAN-CVE-2020-36476

An issue was discovered in Mbed TLS before 2.24.0 and before 2.16.8 LTS and before 2.7.17 LTS. There is missing zeroization of plaintext buffers in mbedtlssslread to erase unused application data from memory...

UBUNTU-CVE-2020-36476

An issue was discovered in Mbed TLS before 2.24.0 and before 2.16.8 LTS and before 2.7.17 LTS. There is missing zeroization of plaintext buffers in mbedtlssslread to erase unused application data from memory...

PT-2021-6687 · Mbed Tls +2 · Mbed Tls +2

Name of the Vulnerable Software and Affected Versions: Mbed TLS versions prior to 2.24.0 Mbed TLS versions prior to 2.16.8 LTS Mbed TLS versions prior to 2.7.17 LTS Description: The issue is related to the missing zeroization of plaintext buffers in the mbedtls ssl read function, which fails to...

openssl: Read/write after SSL object in error state

OpenSSL 1.0.2 starting from version 1.0.2b introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error state and would immediately fail if you attempted to continue the handshake. This works as designed for the...

openssl: Read/write after SSL object in error state

OpenSSL 1.0.2 starting from version 1.0.2b introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error state and would immediately fail if you attempted to continue the handshake. This works as designed for the...

SSL MITM Vulnerability

No description provided by source. include errno.h include stdio.h include string.h include unistd.h include sys/time.h include sys/socket.h include netinet/in.h include arpa/inet.h include netdb.h include openssl/ssl.h include openssl/ssl3.h void failconst char proc perrorproc; exit1; void...