CVE-2023-52353 Security feature bypass in n/a
Attackers can downgrade TLS security by exploiting session reset flaws in Mbed TLS, forcing connections to use weaker protocols than intended.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-52353?
CVE-2023-52353 is a high-severity vulnerability in Arm Mbed Tls, published on 21 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Mbed TLS through 3.5.1. In mbedtls_ssl_session_reset, the maximum negotiable TLS version is mishandled. For example, if the last connection negotiated TLS 1.2, then 1.2 becomes the new maximum.
Weakness: CWE-384
Which versions are affected by CVE-2023-52353?
It affects 1 product.
Products include Arm Mbed Tls.
How do I fix CVE-2023-52353?
No fix has been published for CVE-2023-52353 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-52353 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-52353 exists.
Other vulnerabilities in Arm Mbed Tls
Sources
Also known as GHSA-jggj-wjwc-8gg9.