| Package | Affected versions | Patched versions |
|---|---|---|
| mbed tls | < 2.28.10 | 2.28.10 |
| mbed tls | ≥ 3.0.0, < 3.6.3 | 3.6.3 |
Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client application calls mbedtls_ssl_set_hostname.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free