Bug 2382181 (CVE-2025-48965)

Summary: CVE-2025-48965 mbedtls: Mbed TLS: NULL Pointer Dereference
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in mbedtls. The `mbedtls_asn1_store_named_data` function experiences a NULL pointer dereference when `val.p` is NULL while `val.len` is greater than zero, leading to a potential crash. This flaw allows a network-based attacker to trigger this condition, resulting in a denial of service.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2382236, 2382239, 2382242, 2382244, 2382235, 2382237, 2382238, 2382240, 2382241, 2382243, 2382245    
Bug Blocks:    

Description OSIDB Bzimport 2025-07-20 18:01:09 UTC 
Mbed TLS before 3.6.4 has a NULL pointer dereference because mbedtls_asn1_store_named_data can trigger conflicting data with val.p of NULL but val.len greater than zero.