CyberRota Analysis
AI-GeneratedMbed TLS versions 3.2.0 to 3.6.6 and 4.0.0 to 4.1.0 are vulnerable to an attack where a compromised entropy source can lead to the removal or injection of bytes at the beginning of a TLS 1.3 stream. While the severity is rated low, this vulnerability could potentially weaken the integrity of secure communications. Organizations using these versions of Mbed TLS for TLS 1.3 should prioritize remediation to safeguard against potential data manipulation attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.