Description
An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When negotiating the TLS version on the server side, it can fall back to the TLS 1.2 implementation of the protocol if it is disabled. If the TLS 1.2 implementation was disabled at build time, a TLS 1.2 client could put a TLS 1.3-only server into an infinite loop processing a TLS 1.2 ClientHello, resulting in a denial of service. If the TLS 1.2 implementation was disabled at runtime, a TLS 1.2 client can successfully establish a TLS 1.2 connection with the server.
INFO
Published Date :
2024-04-03T00:00:00.000Z
Last Modified :
2024-11-18T21:32:24.418Z
Source :
mitre
AFFECTED PRODUCTS
The following products are affected by CVE-2024-28836 vulnerability.
| Vendors | Products |
|---|---|
| Arm |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2024-28836.
