CVE-2023-52353

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Mbed TLS through 3.5.1. In mbedtls_ssl_session_reset, the maximum negotiable TLS version is mishandled. For example, if the last connection negotiated TLS 1.2, then 1.2 becomes the new maximum.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-384

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/Mbed-TLS/mbedtls/issues/8654Exploit, Issue Tracking, Patch
https://github.com/Mbed-TLS/mbedtls/issues/8654Exploit, Issue Tracking, Patch

Timeline

Published: Jan 21, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-523547.5chasquid before 1.13 allows SMTP smuggling because LF-terminated lines are accepted.CVE-2023-523557.5An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. Thi CVE-2023-523567.5A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. Th CVE-2023-523577.5Vulnerability of serialization/deserialization mismatch in the vibration framework.Successful exploitation of this vulnerability may affect CVE-2023-523586.2Vulnerability of configuration defects in some APIs of the audio module.Successful exploitation of this vulnerability may affect availabilit CVE-2023-523597.5Vulnerability of permission verification in some APIs in the ActivityTaskManagerService module. Impact: Successful exploitation of this vuln CVE-2023-52366.5A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficie CVE-2023-523607.5Logic vulnerabilities in the baseband.Successful exploitation of this vulnerability may affect service integrity.CVE-2023-523617.5The VerifiedBoot module has a vulnerability that may cause authentication errors.Successful exploitation of this vulnerability may affect in CVE-2023-523627.5Permission management vulnerability in the lock screen module.Successful exploitation of this vulnerability may affect availability.CVE-2023-523635.3Vulnerability of defects introduced in the design process in the Control Panel module.Successful exploitation of this vulnerability may caus CVE-2023-523646.3Vulnerability of input parameters being not strictly verified in the RSMC module. Impact: Successful exploitation of this vulnerability may