CVE-2020-36425

Published: Jul 19, 2021Modified: Nov 21, 2024

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

An issue was discovered in Arm Mbed TLS before 2.24.0. It incorrectly uses a revocationDate check when deciding whether to honor certificate revocation via a CRL. In some situations, an attacker can exploit this by changing the local clock.

Affected (4)

Products: Arm: Mbed Tls · Debian: Debian Linux

1 product

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Arm Mbed Tls	Before 2.7.17
Arm Mbed Tls	From 2.17.0 to 2.24.0
Arm Mbed Tls	From 2.8.0 to 2.16.8

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0

Related CWEs

CWE-295

Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

References (14)

https://bugs.gentoo.org/740108

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://github.com/ARMmbed/mbedtls/issues/3340

Source: cve@mitre.org

ExploitIssue TrackingThird Party Advisory

https://github.com/ARMmbed/mbedtls/pull/3433

Source: cve@mitre.org

Third Party Advisory

https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.8

Source: cve@mitre.org

Release NotesThird Party Advisory

https://github.com/ARMmbed/mbedtls/releases/tag/v2.24.0

Source: cve@mitre.org

Release NotesThird Party Advisory

https://github.com/ARMmbed/mbedtls/releases/tag/v2.7.17

Source: cve@mitre.org

Release NotesThird Party Advisory

https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://bugs.gentoo.org/740108