There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in Mbed TLS before 2.28.9 and 3.x before 3.6.1, in which the user-selected
    algorithm is not used. Unlike previously documented, enabling MBEDTLS_PSA_HMAC_DRBG_MD_TYPE does not cause
    the PSA subsystem to use HMAC_DRBG: it uses HMAC_DRBG only when MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG and
    MBEDTLS_CTR_DRBG_C are disabled. (CVE-2024-45157)

  - An issue was discovered in Mbed TLS 3.6 before 3.6.1. A stack buffer overflow in
    mbedtls_ecdsa_der_to_raw() and mbedtls_ecdsa_raw_to_der() can occur when the bits parameter is larger than
    the largest supported curve. In some configurations with PSA disabled, all values of bits are affected.
    (This never happens in internal library calls, but can affect applications that call these functions
    directly.) (CVE-2024-45158)

  - An issue was discovered in Mbed TLS 3.x before 3.6.1. With TLS 1.3, when a server enables optional
    authentication of the client, if the client-provided certificate does not have appropriate values in if
    keyUsage or extKeyUsage extensions, then the return value of mbedtls_ssl_get_verify_result() would
    incorrectly have the MBEDTLS_X509_BADCERT_KEY_USAGE and MBEDTLS_X509_BADCERT_KEY_USAGE bits clear. As a
    result, an attacker that had a certificate valid for uses other than TLS client authentication would
    nonetheless be able to use it for TLS client authentication. Only TLS 1.3 servers were affected, and only
    with optional authentication (with required authentication, the handshake would be aborted with a fatal
    alert). (CVE-2024-45159)

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 在 之前的 Mbed TLS 3.6 中发现一个问题 3.6.1。当 bits 参数大于支持的最大曲线时mbedtls_ecdsa_der_to_raw() 和 mbedtls_ecdsa_raw_to_der() 中可能发生堆栈缓冲区溢出。在某些禁用了 PSA 的配置中所有位的值都会受到影响。
    这在内部库调用中绝不会发生但会影响直接调用这些函数的应用程序。(CVE-2024-45158)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 在 3.6.1之前的 Mbed TLS 3.6 中發現一個問題。位元參數大於最大支援曲線時mbedtls_ecdsa_der_to_raw() 和 mbedtls_ecdsa_raw_to_der() 中會發生堆疊緩衝區溢位。在停用 PSA 的某些組態中所有位元值都會受到影響。
    (內部程式庫呼叫絕不會發生這種情況但會影響直接呼叫這些函式的應用程式。)(CVE-2024-45158)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - 3.6.1より前の Mbed TLS 3.6 で問題が発見されました。mbedtls_ecdsa_der_to_raw() および mbedtls_ecdsa_raw_to_der() のスタックバッファオーバーフローは、ビットパラメーターがサポートされている最大カーブよりも大きい場合に発生する可能性があります。PSAが無効になっている一部の構成では、ビットのすべての値が影響を受けます。
    これが内部ライブラリの呼び出しでは発生しませんが、これらの関数を直接呼び出すアプリケーションに影響を与える可能性があります。CVE-2024-45158

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in Mbed TLS 3.6 before 3.6.1. A stack buffer overflow in     mbedtls_ecdsa_der_to_raw() and mbedtls_ecdsa_raw_to_der() can occur when the bits parameter is larger than     the largest supported curve. In some configurations with PSA disabled, all values of bits are affected.
    (This never happens in internal library calls, but can affect applications that call these functions     directly.) (CVE-2024-45158)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
424147	Alpine: multiple mbedtls packages: security update to 3.6.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	4/4/2025	7/2/2026	critical
424147	Alpine: multiple mbedtls packages: security update to 3.6.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	4/4/2025	7/2/2026	critical
408496	Alpine: mbedtls: security update to 3.6.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	9/1/2024	12/15/2025	critical
408496	Alpine: mbedtls: security update to 3.6.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	9/1/2024	12/15/2025	critical
249429	Linux Distros 未修补的漏洞：CVE-2024-45158	Nessus	Misc.	8/15/2025	7/25/2026	critical
249429	Linux Distros 未修補的弱點：CVE-2024-45158	Nessus	Misc.	8/15/2025	7/25/2026	critical
249429	Linux Distros のパッチ未適用の脆弱性: CVE-2024-45158	Nessus	Misc.	8/15/2025	7/25/2026	critical
249429	Linux Distros Unpatched Vulnerability : CVE-2024-45158	Nessus	Misc.	8/15/2025	7/25/2026	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical