← Back

CVE-2020-36478

nvd nist
Published: Aug 23, 2021Modified: Nov 21, 2024

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Exploitability: 3.9 / Impact: 3.6
Source: NVD

Description

An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). A NULL algorithm parameters entry looks identical to an array of REAL (size zero) and thus the certificate is considered valid. However, if the parameters do not match in any way, then the certificate should be considered invalid.

Affected (11)

Arm
1 product
Mbed Tls
Siemens
6 products
Logo! Cmr2020 Firmware
Logo! Cmr2040 Firmware
Simatic Rtu3031c Firmware
Simatic Rtu3041c Firmware
Simatic Rtu3030c Firmware
Simatic Rtu3000c Firmware
Debian
1 product
Debian Linux
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Arm
Mbed Tls
Before 2.7.18
Mbed Tls
From 2.17.0 to 2.25.0
Mbed Tls
From 2.8.0 to 2.16.9
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Logo! Cmr2020 Firmware
Before 2.2
Running on/withPlatform Versions
Siemens
Logo! Cmr2020
All versions
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Logo! Cmr2040 Firmware
Before 2.2
Running on/withPlatform Versions
Siemens
Logo! Cmr2040
All versions
Configuration D
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Simatic Rtu3031c Firmware
All versions
Running on/withPlatform Versions
Siemens
Simatic Rtu3031c
All versions
Configuration E
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Simatic Rtu3041c Firmware
All versions
Running on/withPlatform Versions
Siemens
Simatic Rtu3041c
All versions
Configuration F
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Simatic Rtu3030c Firmware
All versions
Running on/withPlatform Versions
Siemens
Simatic Rtu3030c
All versions
Configuration G
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Simatic Rtu3000c Firmware
All versions
Running on/withPlatform Versions
Siemens
Simatic Rtu3000c
All versions
Configuration H
2 vulnerable
Vulnerable SoftwareAffected Versions
Debian
Debian Linux
Version 10.0
Debian Linux
Version 9.0

Related CWEs

CWE-295
Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.

References (14)

Source: cve@mitre.org
PatchThird Party Advisory
Source: cve@mitre.org
ExploitThird Party Advisory
Source: cve@mitre.org
Release NotesThird Party Advisory
Source: cve@mitre.org
Release NotesThird Party Advisory
Source: cve@mitre.org
Release NotesThird Party Advisory
Source: cve@mitre.org
Mailing ListThird Party Advisory
Source: cve@mitre.org
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Release NotesThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Release NotesThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Release NotesThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory

Timeline

No history available yet.