CVE-2020-36476: High severity mbed tls vulnerability
An issue was discovered in Mbed TLS before 2.24.0 (and before 2.16.8 LTS and before 2.7.17 LTS). There is missing zeroization of plaintext buffers in mbedtlssslread to erase unused application data from memory.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-36476?
CVE-2020-36476 is a vulnerability in Mbed TLS before versions 2.24.0, 2.16.8 LTS, and 2.7.17 LTS that allows attackers to access sensitive data in memory.
How can the CVE-2020-36476 vulnerability be exploited?
The CVE-2020-36476 vulnerability can be exploited by an attacker to read sensitive information from memory by taking advantage of missing zeroization of plaintext buffers in the mbedtls_ssl_read function.
What is the severity of CVE-2020-36476?
CVE-2020-36476 has a severity score of 7.5 (high).
Which software versions are affected by CVE-2020-36476?
The following versions of Mbed TLS and Debian Linux are affected: Mbed TLS versions up to (excluding) 2.7.17, 2.8.0 up to (excluding) 2.16.8, and 2.17.0 up to (excluding) 2.24.0. Debian Linux versions 9.0 and 10.0.
How can I fix the CVE-2020-36476 vulnerability?
To fix the CVE-2020-36476 vulnerability, update Mbed TLS to version 2.24.0, 2.16.8 LTS, or 2.7.17 LTS, depending on the affected version. Additionally, update Debian Linux to the latest available version.