Improper Authentication in mbed TLS - CVE-2024-45159
Published: September 2, 2024 / Updated: July 13, 2026
Vulnerability identifier: #VU96651
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-45159
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to authenticate with a wrong certificate.
The vulnerability exists due to an error when a server enables optional authentication of the client and TLS 1.3 is used. if the client-provided certificate does not have appropriate values in keyUsage or extKeyUsage extensions, then the return value of mbedtls_ssl_get_verify_result() would incorrectly have the MBEDTLS_X509_BADCERT_KEY_USAGE and MBEDTLS_X509_BADCERT_EXT_KEY_USAGE bits
clear. As a result, an attacker that had a certificate valid for uses other than TLS client authentication could be able to use it for TLS client authentication anyway.
Affected software
mbed TLS
Fedora
mbedtls
mbedtls3.6
Splunk AppDynamics Private Synthetic Agent
Fedora
mbedtls
mbedtls3.6
Splunk AppDynamics Private Synthetic Agent
How to mitigate CVE-2024-45159
Install updates from vendor's website.
mbed TLS - update to 3.6.1
mbedtls - update to 2.28.9-1.fc41
mbedtls3.6 - update to 3.6.1-1.fc41
Splunk AppDynamics Private Synthetic Agent - update to 25.7.0
mbedtls - update to 2.28.9-1.fc41
mbedtls3.6 - update to 3.6.1-1.fc41
Splunk AppDynamics Private Synthetic Agent - update to 25.7.0