| Package | Affected versions | Patched versions |
|---|---|---|
| mbed tls | ≥ 2.17.0, < 2.24.0≥ 2.8.0, < 2.16.8< 2.7.17 | 2.24.02.16.82.7.17 |
A Lucky 13 timing side channel in mbedtls_ssl_decrypt_buf in library/ssl_msg.c in Trusted Firmware Mbed TLS through 2.23.0 allows an attacker to recover secret key information. This affects CBC mode because of a computed time difference based on a padding length.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free