TLS 1.3 Client Accepts Unadvertised Group in Mbed TLS

Executive Summary

This vulnerability occurs in Mbed TLS versions 3.6.x before 3.6.7 and 4.1.x before 4.1.2. A TLS 1.3 client incorrectly accepts a HelloRetryRequest that selects an elliptic curve group not listed in the client's supported groups extension. This allows the client to proceed with a group it did not originally agree to use, potentially weakening the security of the key exchange process.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect TLS 1.3 handshake logs for HelloRetryRequest messages selecting unadvertised elliptic curve groups. Use packet capture tools like Wireshark to analyze TLS extensions and supported groups in ClientHello and HelloRetryRequest messages.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability may affect the integrity and confidentiality of the TLS session if exploited. It could allow an attacker to manipulate the key exchange process, potentially leading to unauthorized access or data exposure during secure communications.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Mbed TLS to version 3.6.7 or later for 3.6.x branch, or 4.1.2 or later for 4.1.x branch. Review and update TLS 1.3 client configurations to ensure advertised groups match intended security policies.

Useful 0 Not Useful 0