CVE-2021-44732 Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_session() failure.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Vulnerabilities Discovered in Mbed TLS Affecting Certificate Validation and Memory Security Two vulnerabilities were identified in Mbed TLS, affecting versions prior to 2.25.0 and 2.24.0. CVE-2020-36478 allows a NULL algorithm parameters entry to be misinterpreted as valid, while CVE-2020-36476 involves missing zeroization of plaintext buffers, risking exposure of sensitive data. Both issues were published on August 23, 2021. 9 sources 46