CVE-2020-36477

An issue was discovered in Mbed TLS before 2.24.0. The verification of X.509 certificates when matching the expected common name (the cn argument of mbedtls_x509_crt_verify) with the actual certificate name is mishandled: when the subjecAltName extension is present, the expected name is compared to any name in that extension regardless of its type. This means that an attacker could impersonate a 4-byte or 16-byte domain by getting a certificate for the corresponding IPv4 or IPv6 address (this would require the attacker to control that IP address, though).

References

Affected packages

Git / github.com/Mbed-TLS/mbedtls

Affected ranges

Type

GIT

Repo

https://github.com/Mbed-TLS/mbedtls

Events

Introduced

Fixed

523f0554b6cdc7ace5d360885c3f5bbcc73ec0e8

Database specific

Show details

{
    "cpe": "cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.24.0"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

Other

beta-oob-2

mbedos-release-15-11

mbedos-techcon-oob2

mbedtls-2.*

mbedtls-2.0.0

mbedtls-2.1.0

mbedtls-2.1.1

mbedtls-2.1.2

mbedtls-2.10.0

mbedtls-2.11.0

mbedtls-2.12.0

mbedtls-2.13.0

mbedtls-2.13.1

mbedtls-2.14.0

mbedtls-2.16.0

mbedtls-2.19.0

mbedtls-2.19.0d1

mbedtls-2.19.0d2

mbedtls-2.19.1

mbedtls-2.2.0

mbedtls-2.2.1

mbedtls-2.20.0

mbedtls-2.20.0d0

mbedtls-2.21.0

mbedtls-2.22.0d0

mbedtls-2.3.0

mbedtls-2.4.0

mbedtls-2.5.0

mbedtls-2.5.1

mbedtls-2.6.0

mbedtls-2.6.0-rc1

mbedtls-2.7.0

mbedtls-2.7.0-rc1

mbedtls-2.8.0

mbedtls-2.8.0-rc1

mbedtls-2.9.0

polarssl-1.*

polarssl-1.2.0

polarssl-1.2.1

polarssl-1.2.2

polarssl-1.2.4

polarssl-1.2.5

polarssl-1.2.6

polarssl-1.3.0

polarssl-1.3.0-rc0

polarssl-1.3.1

polarssl-1.3.2

polarssl-1.3.3

polarssl-1.3.4

polarssl-1.3.5

polarssl-1.3.6

polarssl-1.3.7

polarssl-1.3.8

polarssl-1.3.9

yotta-2.*

yotta-2.3.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-36477.json"

Git / github.com/mbed-tls/mbedtls