CVE-2020-36475: High severity mbed tls vulnerability
Published Aug 23, 2021
·Updated
An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). The calculations performed by mbedtlsmpiexpmod are not limited; thus, supplying overly large parameters could lead to denial of service when generating Diffie-Hellman key pairs.
Affected Software
17 affected components
Arm mbed TLS<2.7.18
Arm mbed TLS>=2.8.0<2.16.9
Arm mbed TLS>=2.17.0<2.25.0
Siemens Logo\! Cmr2020 Firmware<2.2
Siemens Logo\! Cmr2020
Siemens Logo\! Cmr2040 Firmware<2.2
Siemens Logo\! Cmr2040
Siemens Simatic Rtu3031c Firmware
Siemens Simatic Rtu3031c
Siemens Simatic Rtu3041c Firmware
Siemens Simatic Rtu3041c
Siemens Simatic Rtu3030c Firmware
Siemens Simatic Rtu3030c
Siemens Simatic Rtu3000c Firmware
Siemens Simatic Rtu3000c
Debian Debian Linux=9.0
Debian Debian Linux=10.0
Remediation
Event History
Aug 23, 2021
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Sep 3, 2025
Data Sourced
via Microsoft·10:06 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2020-36475.
2
What is the severity of CVE-2020-36475?
The severity of CVE-2020-36475 is high with a severity value of 7.5.
3
Which software versions are affected by CVE-2020-36475?
CVE-2020-36475 affects Mbed TLS versions before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS).
4
What is the impact of CVE-2020-36475?
CVE-2020-36475 could lead to denial of service when generating Diffie-Hellman key pairs.
5
How can I fix CVE-2020-36475?
To fix CVE-2020-36475, update to Mbed TLS version 2.25.0 (or version 2.16.9 LTS or 2.7.18 LTS) or later.