CVE catalog

CVE-2024-23170

mbedtls: CVE-2024-23170

[CVE catalog]

Severity
Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.31% · Oct 25, 2026

An issue was discovered in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2. There was a timing side channel in RSA private operations. This side channel could be sufficient for a local attacker to recover the plaintext. It requires the attacker to send a large number of messages for decryption, as described in "Everlasting ROBOT: the Marvin Attack" by Hubert Kario.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianmbedtlssid3.6.7-3fixed
Debianmbedtlsforky3.6.7-3fixed
Debianmbedtlstrixie3.6.6-0.1~deb13u1fixed
Debianmbedtlsbookworm2.28.3-1vulnerable
Alpinembedtls3.162.28.7-r0fixed
Alpinembedtls3.172.28.7-r0fixed
Alpinembedtls3.182.28.7-r0fixed
Alpinembedtls3.192.28.7-r0fixed
Alpinembedtls3.202.28.7-r0fixed
Alpinembedtls3.212.28.7-r0fixed
Alpinembedtls3.222.28.7-r0fixed
Alpinembedtls3.232.28.7-r0fixed
Alpinembedtls3.242.28.7-r0fixed
Ubuntumbedtls16.042.1.2-1vulnerable
Ubuntumbedtls16.042.2.0-1vulnerable
Ubuntumbedtls16.042.2.1-1vulnerable
Ubuntumbedtls16.042.2.1-2vulnerable
Ubuntumbedtls16.042.2.1-2ubuntu0.1vulnerable
Ubuntumbedtls16.042.2.1-2ubuntu0.2vulnerable
Ubuntumbedtls16.042.2.1-2ubuntu0.3vulnerable
Ubuntumbedtlspro2.16.9-0.1ubuntu1vulnerable
Ubuntumbedtlspro2.16.11-0.1ubuntu1vulnerable
Ubuntumbedtlspro2.16.11-0.3vulnerable
Ubuntumbedtlspro2.28.0-1vulnerable
Ubuntumbedtlspro2.28.0-1build1vulnerable
Ubuntumbedtlspro2.28.0-1ubuntu0.1~esm1vulnerable
Susembedtlspackage hub 15 sp52.28.7-bp155.2.3.1fixed
Opensusembedtlsleap 15.52.28.7-bp155.2.3.1fixed
Opensusembedtls-2tumbleweed2.28.7-1.1fixed
Opensusembedtlstumbleweed3.5.2-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianmbedtlssourcesid2.28.7-1not yet assignedNot reportedNot reported
Debianmbedtlssourceforky2.28.7-1not yet assignedNot reportedNot reported
Debianmbedtlssourcetrixie2.28.7-1not yet assignedNot reportedNot reported
Debianmbedtlssourcebookworm(unfixed)not yet assignedNot reportedNot reported
Alpinembedtlsapk3.162.28.7-r0Not reportedALPINE-CVE-2024-23170Not reported
Alpinembedtlsapk3.172.28.7-r0Not reportedALPINE-CVE-2024-23170Not reported
Alpinembedtlsapk3.182.28.7-r0Not reportedALPINE-CVE-2024-23170Not reported
Alpinembedtlsapk3.192.28.7-r0Not reportedALPINE-CVE-2024-23170Not reported
Alpinembedtlsapk3.202.28.7-r0Not reportedALPINE-CVE-2024-23170Not reported
Alpinembedtlsapk3.212.28.7-r0Not reportedALPINE-CVE-2024-23170Not reported
Alpinembedtlsapk3.222.28.7-r0Not reportedALPINE-CVE-2024-23170Not reported
Alpinembedtlsapk3.232.28.7-r0Not reportedALPINE-CVE-2024-23170Not reported
Alpinembedtlsapk3.242.28.7-r0Not reportedALPINE-CVE-2024-23170Not reported
Susembedtlsrpmpackage hub 15 sp52.28.7-bp155.2.3.1Not reportedOPENSUSE-SU-2024:0037-1Not reported
Opensusembedtlsrpmleap 15.52.28.7-bp155.2.3.1Not reportedOPENSUSE-SU-2024:0037-1Not reported
Opensusembedtls-2rpmtumbleweed2.28.7-1.1Not reportedOPENSUSE-SU-2024:13640-1Not reported
Opensusembedtlsrpmtumbleweed3.5.2-1.1Not reportedOPENSUSE-SU-2024:13639-1Not reported

Notes

[bookworm] mbedtls: Minor issue

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]