Detections
Analytics
Alpine: multiple mbedtls2 packages: security update to 2.28.10-r0
medium Tenable Cloud Security Plugin ID 426483
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- An issue was discovered in Mbed TLS before 2.28.9 and 3.x before 3.6.1, in which the user-selected
algorithm is not used. Unlike previously documented, enabling MBEDTLS_PSA_HMAC_DRBG_MD_TYPE does not cause
the PSA subsystem to use HMAC_DRBG: it uses HMAC_DRBG only when MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG and
MBEDTLS_CTR_DRBG_C are disabled. (CVE-2024-45157)
- Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted
certificates for arbitrary hostnames unless the TLS client application calls mbedtls_ssl_set_hostname.
(CVE-2025-27809)
- Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware
errors, uses uninitialized stack memory to compose the TLS Finished message, potentially leading to
authentication bypasses such as replays. (CVE-2025-27810)
See Also
https://security.alpinelinux.org/vuln/CVE-2024-45157
Plugin Details
Severity: Medium
ID: 426483
Version: Revision 1.9
Type: Local
Published: 5/16/2025
Updated: 6/8/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.26
CVSS v2
Risk Factor: Medium
Base Score: 4
Temporal Score: 3
Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:N
CVSS Score Source: CVE-2025-27810
CVSS v3
Risk Factor: Medium
Base Score: 5.1
Temporal Score: 4.5
Vector: CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS Score Source: CVE-2024-45157
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 9/3/2024