Apache Mynewt NimBLE: Invalid error handling in pause encryp… (CVE-2025-52435)

Résumé

Apache Mynewt NimBLE: Invalid error handling in pause encryption procedure in NimBLE controller

Description d'origine

La description telle que publiée par la source (souvent en anglais).

J2EE Misconfiguration: Data Transmission Without Encryption vulnerability in Apache NimBLE.

Improper handling of Pause Encryption procedure on Link Layer results in a previously encrypted connection being left in un-encrypted state allowing an eavesdropper to observe the remainder of the exchange.
This issue affects Apache NimBLE: through <= 1.8.0.

Users are recommended to upgrade to version 1.9.0, which fixes the issue.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Références

advisory github.com
advisory lists.apache.org
advisory nvd.nist.gov
patch github.com
patch github.com
web openwall.com