CVE-2024-30166: 
Mbed TLS vulnerability analysis and mitigation

A vulnerability (CVE-2024-30166) was discovered in Mbed TLS versions 3.3.0 through 3.5.2 before 3.6.0. The vulnerability affects TLS 1.3 servers and was disclosed in March 2024 (Mbed Release).

The vulnerability is characterized as a stack buffer over-read vulnerability of less than 256 bytes that occurs when a TLS 1.3 server processes a TLS 3.1 ClientHello message. The issue has been assigned a CVSS v3.1 base score of 9.1 CRITICAL with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H, indicating high severity (NVD).

When exploited, this vulnerability can lead to information disclosure or denial of service in affected TLS 1.3 servers. The high CVSS score indicates that the vulnerability can be exploited remotely without requiring privileges or user interaction (NVD).

The vulnerability can be triggered by a malicious client sending specially crafted TLS 3.1 ClientHello messages to an affected TLS 1.3 server. The attack vector is network-accessible and requires low attack complexity (NVD).

The vulnerability has been fixed in Mbed TLS version 3.6.0. Users are advised to upgrade to this version or later to address the security issue. The fix was included as part of the security improvements in the 3.6.0 release (Mbed Release).