Catalogo CVE

CVE-2024-45158

mbedtls affected and fixed versions

An issue was discovered in Mbed TLS 3.6 before 3.6.1. A stack buffer overflow in mbedtls_ecdsa_der_to_raw() and mbedtls_ecdsa_raw_to_der() can occur when the bits parameter is larger than the largest supported curve. In some configurations with PSA disabled, all values of bits are affected. (This never happens in internal library calls, but can affect applications that call these functions directly.)

Gravità: Low
Published: Sep 5, 2024, 7:15:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.68% · Oct 27, 2026

Projects and upstream resources

[mbedtls][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Alpine3.24	mbedtls	`3.6.1-r0`	Fixed	[ALPINE-CVE-2024-45158]Sep 15, 2026, 8:17:48 AM UTC
Alpine3.23	mbedtls	`3.6.1-r0`	Fixed	[ALPINE-CVE-2024-45158]Sep 15, 2026, 8:17:48 AM UTC
Alpine3.22	mbedtls	`3.6.1-r0`	Fixed	[ALPINE-CVE-2024-45158]Sep 15, 2026, 8:17:48 AM UTC
Alpine3.21	mbedtls	`3.6.1-r0`	Fixed	[ALPINE-CVE-2024-45158]Sep 15, 2026, 8:17:48 AM UTC
Alpine3.20	mbedtls	`3.6.1-r0`	Fixed	[ALPINE-CVE-2024-45158]Sep 15, 2026, 8:17:48 AM UTC

Showing 5 fix observations. All 14 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
UnknownRelease not reported	mbedtls	Not reported	UnknownSource applicability is not established	Provider not reported
Alpine3.20	mbedtls	`3.6.1-r0`	Fixed	[ALPINE-CVE-2024-45158]Sep 15, 2026, 8:17:48 AM UTC
Alpine3.21	mbedtls	`3.6.1-r0`	Fixed	[ALPINE-CVE-2024-45158]Sep 15, 2026, 8:17:48 AM UTC
Alpine3.22	mbedtls	`3.6.1-r0`	Fixed	[ALPINE-CVE-2024-45158]Sep 15, 2026, 8:17:48 AM UTC
Alpine3.23	mbedtls	`3.6.1-r0`	Fixed	[ALPINE-CVE-2024-45158]Sep 15, 2026, 8:17:48 AM UTC
Alpine3.24	mbedtls	`3.6.1-r0`	Fixed	[ALPINE-CVE-2024-45158]Sep 15, 2026, 8:17:48 AM UTC
Debianbookworm	mbedtls	Not reported	Not affectedDistribution reports not affected	[CVE-2024-45158]
Debianbookworm	mbedtls	`2.28.3-1`	Not affected	[CVE-2024-45158]
Debianforky	mbedtls	Not reported	Not affectedDistribution reports not affected	[CVE-2024-45158]
Debianforky	mbedtls	`3.6.7-3`	Not affected	[CVE-2024-45158]
Debiansid	mbedtls	Not reported	Not affectedDistribution reports not affected	[CVE-2024-45158]
Debiansid	mbedtls	`3.6.7-3`	Not affected	[CVE-2024-45158]
Debiantrixie	mbedtls	Not reported	Not affectedDistribution reports not affected	[CVE-2024-45158]
Debiantrixie	mbedtls	`3.6.6-0.1~deb13u1`	Not affected	[CVE-2024-45158]

Original provider fields

{
  "package_releases": [
    {
      "name": "mbedtls",
      "status": "not affected",
      "release": "sid",
      "version": "3.6.7-3"
    },
    {
      "name": "mbedtls",
      "status": "not affected",
      "release": "forky",
      "version": "3.6.7-3"
    },
    {
      "name": "mbedtls",
      "status": "not affected",
      "release": "trixie",
      "version": "3.6.6-0.1~deb13u1"
    },
    {
      "name": "mbedtls",
      "status": "not affected",
      "release": "bookworm",
      "version": "2.28.3-1"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "mbedtls",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "unimportant",
      "fixed_version": "0"
    },
    {
      "bug": null,
      "name": "mbedtls",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "unimportant",
      "fixed_version": "0"
    },
    {
      "bug": null,
      "name": "mbedtls",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "unimportant",
      "fixed_version": "0"
    },
    {
      "bug": null,
      "name": "mbedtls",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "unimportant",
      "fixed_version": "0"
    }
  ],
  "distribution_packages": [
    {
      "name": "mbedtls",
      "fixed_version": "0",
      "applicability_unknown": true
    },
    {
      "name": "mbedtls",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.1-r0"
            }
          ]
        }
      ],
      "release": "3.20",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2024-45158",
      "fixed_version": "3.6.1-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2024-45158",
      "provider_updated_at": "2026-09-15T08:17:48.478580416Z"
    },
    {
      "name": "mbedtls",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.1-r0"
            }
          ]
        }
      ],
      "release": "3.21",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2024-45158",
      "fixed_version": "3.6.1-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2024-45158",
      "provider_updated_at": "2026-09-15T08:17:48.478580416Z"
    },
    {
      "name": "mbedtls",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.1-r0"
            }
          ]
        }
      ],
      "release": "3.22",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2024-45158",
      "fixed_version": "3.6.1-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2024-45158",
      "provider_updated_at": "2026-09-15T08:17:48.478580416Z"
    },
    {
      "name": "mbedtls",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.1-r0"
            }
          ]
        }
      ],
      "release": "3.23",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2024-45158",
      "fixed_version": "3.6.1-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2024-45158",
      "provider_updated_at": "2026-09-15T08:17:48.478580416Z"
    },
    {
      "name": "mbedtls",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.1-r0"
            }
          ]
        }
      ],
      "release": "3.24",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2024-45158",
      "fixed_version": "3.6.1-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2024-45158",
      "provider_updated_at": "2026-09-15T08:17:48.478580416Z"
    }
  ]
}

OpenFactory catalog packages

L’associazione dei pacchetti è in corso.

[Debian 12 (Bookworm)]

[libmbedcrypto7]Sconosciuto
Pacchetto sorgente: [mbedtls]
Dettagli (2)
- 2.28.3-1 · amd64 · bookworm
  Non interessata
  dsa · mbedtls · debian · bookworm
- 2.28.3-1 · arm64 · bookworm
  Non interessata
  dsa · mbedtls · debian · bookworm
[libmbedtls14]Sconosciuto
Pacchetto sorgente: [mbedtls]
Dettagli (2)
- 2.28.3-1 · amd64 · bookworm
  Non interessata
  dsa · mbedtls · debian · bookworm
- 2.28.3-1 · arm64 · bookworm
  Non interessata
  dsa · mbedtls · debian · bookworm
[libmbedtls-dev]Sconosciuto
Pacchetto sorgente: [mbedtls]
Dettagli (2)
- 2.28.3-1 · amd64 · bookworm
  Non interessata
  dsa · mbedtls · debian · bookworm
- 2.28.3-1 · arm64 · bookworm
  Non interessata
  dsa · mbedtls · debian · bookworm
[libmbedtls-doc]Sconosciuto
Pacchetto sorgente: [mbedtls]
Dettagli (2)
- 2.28.3-1 · all · bookworm
  Non interessata
  dsa · mbedtls · debian · bookworm
- 2.28.3-1 · all · bookworm
  Non interessata
  dsa · mbedtls · debian · bookworm
[libmbedx509-1]Sconosciuto
Pacchetto sorgente: [mbedtls]
Dettagli (2)
- 2.28.3-1 · amd64 · bookworm
  Non interessata
  dsa · mbedtls · debian · bookworm
- 2.28.3-1 · arm64 · bookworm
  Non interessata
  dsa · mbedtls · debian · bookworm

Osservato: Oct 27, 2026, 2:10:07 AM UTC

Riferimenti

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]