[Debian-iot-maintainers] Bug#1077686: mbedtls: CVE-2024-28755

[Moritz Mühlenhoff]

Source: mbedtls
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for mbedtls.

CVE-2024-28755[0]:
| An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When an SSL
| context was reset with the mbedtls_ssl_session_reset() API, the
| maximum TLS version to be negotiated was not restored to the
| configured one. An attacker was able to prevent an Mbed TLS server
| from establishing any TLS 1.3 connection, potentially resulting in a
| Denial of Service or forced version downgrade from TLS 1.3 to TLS
| 1.2.

https://github.com/Mbed-TLS/mbedtls/issues/8654

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-28755
    https://www.cve.org/CVERecord?id=CVE-2024-28755

Please adjust the affected versions in the BTS as needed.