CVEvulnerability

CVE-2020-36478

7.5 HIGH Published 2021-08-23 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-08-23
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
Weaknesses
CWE-295

Description

An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). A NULL algorithm parameters entry looks identical to an array of REAL (size zero) and thus the certificate is considered valid. However, if the parameters do not match in any way, then the certificate should be considered invalid.

Affected configurations

• arm mbed tls (< 2.7.18) • arm mbed tls (>= 2.8.0 < 2.16.9) • arm mbed tls (>= 2.17.0 < 2.25.0) • siemens logo\! cmr2020 firmware (< 2.2) • siemens logo\! cmr2040 firmware (< 2.2) • siemens simatic rtu3031c firmware • siemens simatic rtu3041c firmware • siemens simatic rtu3030c firmware • siemens simatic rtu3000c firmware • debian debian linux 9.0 • debian debian linux 10.0

Related

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References