CVEvulnerability

CVE-2017-14032

8.1 HIGH Published 2017-08-30 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-08-30
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
8.1 HIGH — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-287

Description

ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates. NOTE: although mbed TLS was formerly known as PolarSSL, the releases shipped with the PolarSSL name are not affected.

Affected configurations

• arm mbed tls 1.3.19 • arm mbed tls 1.3.21 • arm mbed tls 2.1.7 • arm mbed tls 2.1.9 • arm mbed tls 2.4.2 • arm mbed tls 2.6.2 • trustedfirmware mbed tls 1.3.10 • trustedfirmware mbed tls 1.3.11 • trustedfirmware mbed tls 1.3.12 • trustedfirmware mbed tls 1.3.13 • trustedfirmware mbed tls 1.3.14 • trustedfirmware mbed tls 1.3.15 • trustedfirmware mbed tls 1.3.16 • trustedfirmware mbed tls 1.3.17 • trustedfirmware mbed tls 1.3.18 • trustedfirmware mbed tls 1.3.20 • trustedfirmware mbed tls 2.0.0 • trustedfirmware mbed tls 2.1.0 • trustedfirmware mbed tls 2.1.1 • trustedfirmware mbed tls 2.1.2 • trustedfirmware mbed tls 2.1.3 • trustedfirmware mbed tls 2.1.4 • trustedfirmware mbed tls 2.1.5 • trustedfirmware mbed tls 2.1.6 • trustedfirmware mbed tls 2.1.8 • trustedfirmware mbed tls 2.2.0 • trustedfirmware mbed tls 2.2.1 • trustedfirmware mbed tls 2.3.0 • trustedfirmware mbed tls 2.4.0 • trustedfirmware mbed tls 2.5.1

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References