CVE-2017-14032

Published: Aug 30, 2017Modified: Jun 5, 2026

8.1

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 5.9

Source: NVD

Description

ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates. NOTE: although mbed TLS was formerly known as PolarSSL, the releases shipped with the PolarSSL name are not affected.

Affected (30)

Products: Arm: Mbed Tls · Trustedfirmware: Mbed Tls

1 product

1 product

Configuration A

30 vulnerable

Vulnerable Software	Affected Versions
Arm Mbed Tls	Version 1.3.19
Arm Mbed Tls	Version 1.3.21
Arm Mbed Tls	Version 2.1.7
Arm Mbed Tls	Version 2.1.9
Arm Mbed Tls	Version 2.4.2
Arm Mbed Tls	Version 2.6.2
Trustedfirmware Mbed Tls	Version 1.3.10
Trustedfirmware Mbed Tls	Version 1.3.11
Trustedfirmware Mbed Tls	Version 1.3.12
Trustedfirmware Mbed Tls	Version 1.3.13
Trustedfirmware Mbed Tls	Version 1.3.14
Trustedfirmware Mbed Tls	Version 1.3.15
Trustedfirmware Mbed Tls	Version 1.3.16
Trustedfirmware Mbed Tls	Version 1.3.17
Trustedfirmware Mbed Tls	Version 1.3.18
Trustedfirmware Mbed Tls	Version 1.3.20
Trustedfirmware Mbed Tls	Version 2.0.0
Trustedfirmware Mbed Tls	Version 2.1.0
Trustedfirmware Mbed Tls	Version 2.1.1
Trustedfirmware Mbed Tls	Version 2.1.2
Trustedfirmware Mbed Tls	Version 2.1.3
Trustedfirmware Mbed Tls	Version 2.1.4
Trustedfirmware Mbed Tls	Version 2.1.5
Trustedfirmware Mbed Tls	Version 2.1.6
Trustedfirmware Mbed Tls	Version 2.1.8
Trustedfirmware Mbed Tls	Version 2.2.0
Trustedfirmware Mbed Tls	Version 2.2.1
Trustedfirmware Mbed Tls	Version 2.3.0
Trustedfirmware Mbed Tls	Version 2.4.0
Trustedfirmware Mbed Tls	Version 2.5.1