CVE Vulnerability

CVE-2020-36478

An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). A NULL algorithm parameters entry looks identical to an array of REAL (size zero) and thus the certificate is considered valid. However, if the parameters do not match in any way, then the certificate should be considered invalid.

5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

7.5 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.9 Release Notes Third Party Advisory
https://github.com/ARMmbed/mbedtls/releases/tag/v2.25.0 Release Notes Third Party Advisory
https://github.com/ARMmbed/mbedtls/issues/3629 Exploit Third Party Advisory
https://github.com/ARMmbed/mbedtls/releases/tag/v2.7.18 Release Notes Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-756638.pdf Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/11/msg00021.html Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html Mailing List Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*
cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*
cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Information

Published : 2021-08-23 02:15

Updated : 2023-01-11 05:01

NVD link : CVE-2020-36478

Mitre link : CVE-2020-36478

Products Affected
No products.
CWE
CWE-295

Improper Certificate Validation