Search Results (Refine Search)
- Results Type: Overview
- Keyword (text search): cpe:2.3:a:matrixssl:matrixssl:4.3.0:*:*:*:*:*:*:*
- CPE Name Search: true
Vuln ID | Summary | CVSS Severity |
---|---|---|
CVE-2023-24609 |
Matrix SSL 4.x through 4.6.0 and Rambus TLS Toolkit have a length-subtraction integer overflow for Client Hello Pre-Shared Key extension parsing in the TLS 1.3 server. An attacked device calculates an SHA-2 hash over at least 65 KB (in RAM). With a large number of crafted TLS messages, the CPU becomes heavily loaded. This occurs in tls13VerifyBinder and tls13TranscriptHashUpdate. Published: December 21, 2023; 11:15:08 PM -0500 |
V3.1: 7.5 HIGH V2.0:(not available) |
CVE-2022-46505 |
An issue in MatrixSSL 4.5.1-open and earlier leads to failure to securely check the SessionID field, resulting in the misuse of an all-zero MasterSecret that can decrypt secret data. Published: January 18, 2023; 11:15:11 AM -0500 |
V3.1: 7.5 HIGH V2.0:(not available) |
CVE-2022-43974 |
MatrixSSL 4.0.4 through 4.5.1 has an integer overflow in matrixSslDecodeTls13. A remote attacker might be able to send a crafted TLS Message to cause a buffer overflow and achieve remote code execution. This is fixed in 4.6.0. Published: January 09, 2023; 4:15:10 AM -0500 |
V3.1: 9.8 CRITICAL V2.0:(not available) |