CVE-2023-52353

Summary

CVE-2023-52353 is a vulnerability affecting Mbed TLS versions up to 3.5.1. In this issue, the maximum negotiated TLS version in the mbedtls_ssl_session_reset function is mishandled. Specifically, if the last connection used TLS version 1.2, then 1.2 becomes the new maximum negotiable TLS version for the subsequent connections, potentially leading to downgrade attacks where a lower security TLS version is used. This can expose sensitive data to potential threats and should be addressed by applying the latest security updates to affected systems.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.