Catálogo de CVE

CVE-2024-28755

mbedtls affected and fixed versions

An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When an SSL context was reset with the mbedtls_ssl_session_reset() API, the maximum TLS version to be negotiated was not restored to the configured one. An attacker was able to prevent an Mbed TLS server from establishing any TLS 1.3 connection, potentially resulting in a Denial of Service or forced version downgrade from TLS 1.3 to TLS 1.2.

Gravidade: Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published: Apr 3, 2024, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.41% · Oct 27, 2026

Projects and upstream resources

[mbedtls][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie	mbedtls	`3.6.0-3`	FixedDistribution-reported fixed boundary	[CVE-2024-28755]
Debiantrixie	mbedtls	`3.6.6-0.1~deb13u1`	Fixed	[CVE-2024-28755]
Debiansid	mbedtls	`3.6.0-3`	FixedDistribution-reported fixed boundary	[CVE-2024-28755]
Debiansid	mbedtls	`3.6.7-3`	Fixed	[CVE-2024-28755]
Debianforky	mbedtls	`3.6.0-3`	FixedDistribution-reported fixed boundary	[CVE-2024-28755]
Debianforky	mbedtls	`3.6.7-3`	Fixed	[CVE-2024-28755]

Showing 6 fix observations. All 9 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
UnknownRelease not reported	mbedtls	Not reported	UnknownSource applicability is not established	Provider not reported
Debianbookworm	mbedtls	Not reported	AffectedDistribution reports no fix	[CVE-2024-28755]
Debianbookworm	mbedtls	`2.28.3-1`	Affected	[CVE-2024-28755]
Debianforky	mbedtls	`3.6.0-3`	FixedDistribution-reported fixed boundary	[CVE-2024-28755]
Debianforky	mbedtls	`3.6.7-3`	Fixed	[CVE-2024-28755]
Debiansid	mbedtls	`3.6.0-3`	FixedDistribution-reported fixed boundary	[CVE-2024-28755]
Debiansid	mbedtls	`3.6.7-3`	Fixed	[CVE-2024-28755]
Debiantrixie	mbedtls	`3.6.0-3`	FixedDistribution-reported fixed boundary	[CVE-2024-28755]
Debiantrixie	mbedtls	`3.6.6-0.1~deb13u1`	Fixed	[CVE-2024-28755]

Original provider fields

{
  "package_releases": [
    {
      "name": "mbedtls",
      "status": "fixed",
      "release": "sid",
      "version": "3.6.7-3"
    },
    {
      "name": "mbedtls",
      "status": "fixed",
      "release": "forky",
      "version": "3.6.7-3"
    },
    {
      "name": "mbedtls",
      "status": "fixed",
      "release": "trixie",
      "version": "3.6.6-0.1~deb13u1"
    },
    {
      "name": "mbedtls",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "2.28.3-1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1077686,
      "name": "mbedtls",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "3.6.0-3"
    },
    {
      "bug": 1077686,
      "name": "mbedtls",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "3.6.0-3"
    },
    {
      "bug": 1077686,
      "name": "mbedtls",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "3.6.0-3"
    },
    {
      "bug": 1077686,
      "name": "mbedtls",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "mbedtls",
      "fixed_version": "not yet fixed",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #1077686]

Publisher notes

[bookworm] mbedtls: Minor issue

OpenFactory catalog packages

A associação de pacotes está em andamento.

[Debian 12 (Bookworm)]

[libmbedcrypto7]Desconhecido
Pacote fonte: [mbedtls]
Detalhes (2)
- 2.28.3-1 · amd64 · bookworm
  Afetada
  dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12
- 2.28.3-1 · arm64 · bookworm
  Afetada
  dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12
[libmbedtls14]Desconhecido
Pacote fonte: [mbedtls]
Detalhes (2)
- 2.28.3-1 · amd64 · bookworm
  Afetada
  dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12
- 2.28.3-1 · arm64 · bookworm
  Afetada
  dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12
[libmbedtls-dev]Desconhecido
Pacote fonte: [mbedtls]
Detalhes (2)
- 2.28.3-1 · amd64 · bookworm
  Afetada
  dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12
- 2.28.3-1 · arm64 · bookworm
  Afetada
  dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12
[libmbedtls-doc]Desconhecido
Pacote fonte: [mbedtls]
Detalhes (2)
- 2.28.3-1 · all · bookworm
  Afetada
  dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12
- 2.28.3-1 · all · bookworm
  Afetada
  dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12
[libmbedx509-1]Desconhecido
Pacote fonte: [mbedtls]
Detalhes (2)
- 2.28.3-1 · amd64 · bookworm
  Afetada
  dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12
- 2.28.3-1 · arm64 · bookworm
  Afetada
  dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12

[Debian 13 (Trixie)]

[libmbedcrypto16]Desconhecido
Pacote fonte: [mbedtls]
Detalhes (2)
- 3.6.5-0.1~deb13u1 · amd64 · trixie
  Corrigida · Corrigida: 3.6.0-3
  dsa · mbedtls · debian · 13
- 3.6.5-0.1~deb13u1 · arm64 · trixie
  Corrigida · Corrigida: 3.6.0-3
  dsa · mbedtls · debian · 13
[libmbedtls21]Desconhecido
Pacote fonte: [mbedtls]
Detalhes (2)
- 3.6.5-0.1~deb13u1 · amd64 · trixie
  Corrigida · Corrigida: 3.6.0-3
  dsa · mbedtls · debian · 13
- 3.6.5-0.1~deb13u1 · arm64 · trixie
  Corrigida · Corrigida: 3.6.0-3
  dsa · mbedtls · debian · 13
[libmbedtls-dev]Desconhecido
Pacote fonte: [mbedtls]
Detalhes (2)
- 3.6.5-0.1~deb13u1 · amd64 · trixie
  Corrigida · Corrigida: 3.6.0-3
  dsa · mbedtls · debian · 13
- 3.6.5-0.1~deb13u1 · arm64 · trixie
  Corrigida · Corrigida: 3.6.0-3
  dsa · mbedtls · debian · 13
[libmbedtls-doc]Desconhecido
Pacote fonte: [mbedtls]
Detalhes (2)
- 3.6.5-0.1~deb13u1 · all · trixie
  Corrigida · Corrigida: 3.6.0-3
  dsa · mbedtls · debian · 13
- 3.6.5-0.1~deb13u1 · all · trixie
  Corrigida · Corrigida: 3.6.0-3
  dsa · mbedtls · debian · 13
[libmbedx509-7]Desconhecido
Pacote fonte: [mbedtls]
Detalhes (2)
- 3.6.5-0.1~deb13u1 · amd64 · trixie
  Corrigida · Corrigida: 3.6.0-3
  dsa · mbedtls · debian · 13
- 3.6.5-0.1~deb13u1 · arm64 · trixie
  Corrigida · Corrigida: 3.6.0-3
  dsa · mbedtls · debian · 13

Observado: Oct 28, 2026, 5:36:54 PM UTC

Referências

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]