6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-28755

CVE-2024-28755: An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When an SSL context was reset with the...

An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When an SSL context was reset with the mbedtls_ssl_session_reset() API, the maximum TLS version to be negotiated was not restored to the configured one. An attacker was able to prevent an Mbed TLS server from establishing any TLS 1.3 connection, potentially resulting in a Denial of Service or forced version downgrade from TLS 1.3 to TLS 1.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-28755

CVE-2024-28755:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability description and the fix information from the Mbed TLS 3.6.0 release notes clearly point to the mbedtls_ssl_session_reset() API as the source of the issue. The problem occurs when this function is called, as it fails to properly reset the maximum negotiable TLS version. The fix involves modifying this function to ensure the correct restoration of the TLS version. While the exact code changes are not visible without the commit patch, the available information is sufficient to identify mbedtls_ssl_session_reset() as a key function involved in the vulnerability. The file path is inferred based on common Mbed TLS structure, but cannot be confirmed without the patch. I was unable to fetch the commit information using the provided commit hash, as it appears to be invalid or inaccessible. The Google search also did not yield a direct link to the commit. Therefore, the analysis relies on the textual descriptions of the vulnerability and the fix. The confidence is medium because the exact code changes are unknown, but the function's role is clearly stated in the advisory and release notes. If the commit were available, a higher confidence level could be achieved by examining the specific code modifications within mbedtls_ssl_session_reset() or any related functions it calls that might have been altered to address the version restoration logic.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.