CVE-2023-52353
CVSS 3.1 Score 7.5 of 10 (high)
Details
Published Jan 21, 2024
Updated: Jan 29, 2024
CWE ID 384
Summary
CVE-2023-52353 is a vulnerability affecting Mbed TLS versions up to 3.5.1. In this issue, the maximum negotiated TLS version in the mbedtls_ssl_session_reset function is mishandled. Specifically, if the last connection used TLS version 1.2, then 1.2 becomes the new maximum negotiable TLS version for the subsequent connections, potentially leading to downgrade attacks where a lower security TLS version is used. This can expose sensitive data to potential threats and should be addressed by applying the latest security updates to affected systems.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Share
Affected Products
- ARM mbed TLS
Affected Vendors
- Arm Ltd
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
Note: This is just a basic overview providing quick insights into CVE-2023-52353 information. Gain full access to comprehensive CVE data, third party vulnerabilities, compromised credentials and more with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions