CVE-2020-36478: High severity mbed tls vulnerability
An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). A NULL algorithm parameters entry looks identical to an array of REAL (size zero) and thus the certificate is considered valid. However, if the parameters do not match in any way, then the certificate should be considered invalid.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-36478?
CVE-2020-36478 is a vulnerability in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS) that allows a NULL algorithm parameters entry to be considered valid.
How does CVE-2020-36478 affect ARM mbed TLS?
CVE-2020-36478 affects ARM mbed TLS versions before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS) by allowing a NULL algorithm parameters entry to be considered valid.
Is Siemens Logo! CMR2020 Firmware affected by CVE-2020-36478?
Siemens Logo! CMR2020 Firmware versions up to 2.2 are affected by CVE-2020-36478.
How can I fix CVE-2020-36478?
To fix CVE-2020-36478, update to Mbed TLS version 2.25.0 or later (or versions 2.16.9 LTS and 2.7.18 LTS if available).
What is the severity of CVE-2020-36478?
CVE-2020-36478 has a severity rating of 7.5 (high).