CVE-2017-14032: High severity Arm mbed TLS vulnerability
Published Aug 30, 2017
·Updated
ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates. NOTE: although mbed TLS was formerly known as PolarSSL, the releases shipped with the PolarSSL name are not affected.
Affected Software
54 affected components
Arm mbed TLS=1.3.10
Arm mbed TLS=1.3.11
Arm mbed TLS=1.3.12
Arm mbed TLS=1.3.13
Arm mbed TLS=1.3.14
Arm mbed TLS=1.3.15
Arm mbed TLS=1.3.16
Arm mbed TLS=1.3.17
Arm mbed TLS=1.3.18
Arm mbed TLS=1.3.19
Arm mbed TLS=1.3.20
Arm mbed TLS=1.3.21
Arm mbed TLS=2.0.0
Arm mbed TLS=2.1.0
Arm mbed TLS=2.1.1
Arm mbed TLS=2.1.2
Arm mbed TLS=2.1.3
Arm mbed TLS=2.1.4
Arm mbed TLS=2.1.5
Arm mbed TLS=2.1.6
Arm mbed TLS=2.1.7
Arm mbed TLS=2.1.8
Arm mbed TLS=2.1.9
Arm mbed TLS=2.2.0
Arm mbed TLS=2.2.1
Arm mbed TLS=2.3.0
Arm mbed TLS=2.4.0
Arm mbed TLS=2.4.2
Arm mbed TLS=2.5.1
Arm mbed TLS=2.6.2
TrustedFirmware Mbed Tls=1.3.10
TrustedFirmware Mbed Tls=1.3.11
TrustedFirmware Mbed Tls=1.3.12
TrustedFirmware Mbed Tls=1.3.13
TrustedFirmware Mbed Tls=1.3.14
TrustedFirmware Mbed Tls=1.3.15
TrustedFirmware Mbed Tls=1.3.16
TrustedFirmware Mbed Tls=1.3.17
TrustedFirmware Mbed Tls=1.3.18
TrustedFirmware Mbed Tls=1.3.20
TrustedFirmware Mbed Tls=2.0.0
TrustedFirmware Mbed Tls=2.1.0
TrustedFirmware Mbed Tls=2.1.1
TrustedFirmware Mbed Tls=2.1.2
TrustedFirmware Mbed Tls=2.1.3
TrustedFirmware Mbed Tls=2.1.4
TrustedFirmware Mbed Tls=2.1.5
TrustedFirmware Mbed Tls=2.1.6
TrustedFirmware Mbed Tls=2.1.8
TrustedFirmware Mbed Tls=2.2.0
TrustedFirmware Mbed Tls=2.2.1
TrustedFirmware Mbed Tls=2.3.0
TrustedFirmware Mbed Tls=2.4.0
TrustedFirmware Mbed Tls=2.5.1
Remediation
Patch Available
Event History
Aug 30, 2017
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Data Sourced
via NVD·08:29 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2017-14032?
CVE-2017-14032 is classified as a medium severity vulnerability.
2
How do I fix CVE-2017-14032?
To fix CVE-2017-14032, update to mbed TLS version 1.3.21 or 2.1.9 or later.
3
What types of attacks can CVE-2017-14032 enable?
CVE-2017-14032 can potentially allow remote attackers to bypass peer authentication.
4
Which versions of mbed TLS are affected by CVE-2017-14032?
CVE-2017-14032 affects mbed TLS versions before 1.3.21 and 2.x before 2.1.9.
5
Does CVE-2017-14032 impact the security of my application?
Yes, CVE-2017-14032 can compromise the security of applications relying on proper peer authentication.