Mbed TLS vulnerabilities

A vulnerability in Mbed TLS (versions 2.19.0 to 3.6.5 and 4.0.0) is caused by insufficient protection of serialized SSL structures. An attacker can modify these structures, leading to memory corruption and potential arbitrary code execution.

In Mbed TLS 3.2.0 through 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.

In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts a HelloRetryRequest selecting a group that was not advertised. This can violate TLS 1.3 protocol negotiation expectations.

Mbed TLS 3.x before 3.6.6 has an out-of-bounds read vulnerability in mbedtls_ccm_finish() due to missing validation of the tag_len parameter. An attacker can obtain adjacent CCM context data.