CVE-2025-47917
Mbed TLS before 3.6.4 allows a use-after-free in certain situations of ...
Kaynağa göre önem derecesi
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, Julia. Daha düşük diyenler: Ubuntu (orta).
Açıklama
Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation. The function mbedtls_x509_string_to_names() takes a head argument that is documented as an output argument. The documentation does not suggest that the function will free that pointer; however, the function does call mbedtls_asn1_free_named_data_list() on that argument, which performs a deep free(). As a result, application code that uses this function (relying only on documented behavior) is likely to still hold pointers to the memory blocks that were freed, resulting in a high risk of use-after-free or double-free. In particular, the two sample programs x509/cert_write and x509/cert_req are affected (use-after-free if the san string contains more than one DN).
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| julia::Julia Ecosystem Security Advisories | MbedTLS_jll | 2.28.1010+0 |
| alpine 3.20 | mbedtls | 3.6.4-r0 |
| alpine 3.21 | mbedtls | 3.6.4-r0 |
| alpine 3.22 | mbedtls | 3.6.4-r0 |
| alpine 3.23 | mbedtls | 3.6.4-r0 |
| alpine 3.24 | mbedtls, mbedtls3 | 3.6.4-r0 |
| alpine edge | mbedtls, mbedtls3 | 3.6.4-r0 |
| debian 11 | mbedtls | 2.16.9-0.1+deb11u3 |
| debian 12 | mbedtls | düzeltme belirtilmemiş |
| debian 13 | mbedtls | 3.6.4-1 |
| debian 14 | mbedtls | 3.6.4-1 |
| echo | mbedtls | 3.6.4-1 |
27 kaynaktaki 36 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| julia::Julia Ecosystem Security Advisories | MbedTLS_jll | 2.28.1010+0 |
| alpine 3.20 | mbedtls | 3.6.4-r0 |
| alpine 3.21 | mbedtls | 3.6.4-r0 |
| alpine 3.22 | mbedtls | 3.6.4-r0 |
| alpine 3.23 | mbedtls | 3.6.4-r0 |
| alpine 3.24 | mbedtls | 3.6.4-r0 |
| alpine 3.24 | mbedtls3 | 3.6.4-r0 |
| alpine edge | mbedtls | 3.6.4-r0 |
| alpine edge | mbedtls3 | 3.6.4-r0 |
| debian 11 | mbedtls | 2.16.9-0.1+deb11u3 |
| debian 12 | mbedtls | düzeltme belirtilmemiş |
| debian 13 | mbedtls | 3.6.4-1 |
| debian 14 | mbedtls | 3.6.4-1 |
| echo | mbedtls | 3.6.4-1 |
| rapidfort alpine 3.20 | mbedtls | 3.6.4-r0 |
| rapidfort alpine 3.21 | mbedtls | 3.6.4-r0 |
| rapidfort alpine 3.23 | mbedtls | 3.6.4-r0 |
| rapidfort alpine 3.24 | mbedtls | 3.6.4-r0 |
| rapidfort debian 12 | mbedtls | 0:3.6.4-1 |
| rapidfort debian 12 | rf-mbedtls | 0:3.6.4-1 |
| rapidfort debian 13 | mbedtls | 0:3.6.4-1 |
| rapidfort debian 13 | rf-mbedtls | 0:3.6.4-1 |
| rapidfort ubuntu | mbedtls | 0:2.28.8-10rfubu |
| rapidfort ubuntu | rf-mbedtls | 0:2.28.8-10rfubu |
| rapidfort ubuntu 20.04 | mbedtls | 0:3.6.5-0.1 |
| rapidfort ubuntu 20.04 | rf-mbedtls | 0:3.6.5-0.1 |
| rapidfort ubuntu 22.04 | mbedtls | 0:3.6.5-0.1 |
| rapidfort ubuntu 22.04 | rf-mbedtls | 0:3.6.5-0.1 |
| rapidfort ubuntu 24.04 | mbedtls | 0:3.6.5-0.1 |
| rapidfort ubuntu 24.04 | rf-mbedtls | 0:3.6.5-0.1 |
| root.io debian 12 | mbedtls | 2.28.3-1.root.io.2, 2.28.3-1.root.io.3, 2.28.3-1.root.io.4, 2.28.3-1.root.io.5, 2.28.3-1.root.io.6, 2.28.3-1.root.io.7, 2.28.3-1.root.io.8, 2.28.3-1.root.io.9, 2.28.3-1.root.io.10, 2.28.3-1.root.io.11, 2.28.3-1.root.io.12, 2.28.3-1.root.io.13, 2.28.3-1.root.io.14, 2.28.3-1.root.io.15, 2.28.3-1.root.io.16 |
| root.io debian 12 | rootio-mbedtls | 2.28.3-1.root.io.2, 2.28.3-1.root.io.3, 2.28.3-1.root.io.4, 2.28.3-1.root.io.5, 2.28.3-1.root.io.6, 2.28.3-1.root.io.7, 2.28.3-1.root.io.8, 2.28.3-1.root.io.9, 2.28.3-1.root.io.10, 2.28.3-1.root.io.11, 2.28.3-1.root.io.12, 2.28.3-1.root.io.13, 2.28.3-1.root.io.14, 2.28.3-1.root.io.15, 2.28.3-1.root.io.16 |
| ubuntu 18.04-ESM | mbedtls | 2.8.0-1ubuntu0.1~esm1 |
| ubuntu 20.04-ESM | mbedtls | 2.16.4-1ubuntu2+esm1 |
| ubuntu 22.04 | mbedtls | düzeltme belirtilmemiş |
| ubuntu 24.04 | mbedtls | düzeltme belirtilmemiş |
Referanslar
- https://github.com/Mbed-TLS/mbedtls-docs/blob/main/security-advisories/mbedtls-security-advisory-2025-06-7.md
- https://lists.debian.org/debian-lts-announce/2025/08/msg00013.html
- https://lists.debian.org/debian-lts-announce/2025/08/msg00025.html
- https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/
- https://ubuntu.com/security/notices/USN-8123-1
- https://www.cve.org/CVERecord?id=CVE-2025-47917