A vulnerability described as critical has been identified in ARM Mbed TLS up to 2.16.8 LTS/2.7.17 LTS/2.24.x. This issue affects some unknown processing of the component NULL Certificate Handler. The manipulation leads to improper certificate validation.
The identification of this vulnerability is CVE-2020-36478. The attack may be initiated remotely. There is no exploit available.
It is recommended to upgrade the affected component.
Intelligence View
⚡ tsecurity.de Intelligence
CVE-2020-36478 | ARM Mbed TLS up to 2.16.8 LTS/2.7.17 LTS/2.24.x NULL Certificate certificate validation (Nessus ID 249954)
A vulnerability described as critical has been identified in ARM Mbed TLS up to 2.16.8 LTS/2.7.17 LTS/2.24.x. This issue affects some unknown processing of the…
Cyber Threat Intelligence & Forensik
ATT&CK-Navigator · IoC-Radar · Exploit-Belege
Compliance, SLA & Vendor Adherence
Advisory-Prüfung · Score-Einordnung · Fristen
Advisory Radar
Offizielles Hersteller-Update verfügbar
Hersteller-Sicherheitsmeldungen & Patch-Status
Handlungsempfehlung für Administratoren
Hersteller hat ein verifiziertes Patch-Release herausgegeben. Sofortiges Rollout auf Test- und Produktivsystemen empfohlen.
Referenzen aus der Primärquelle („Verifiziert" nur bei Hersteller-Domäne):
-
Upstream-Referenz (Code-Hosting, kein Advisory)github.com
-
Upstream-Referenz (Code-Hosting, kein Advisory)github.com
-
Upstream-Referenz (Code-Hosting, kein Advisory)github.com
-
Upstream-Referenz (Code-Hosting, kein Advisory)github.com
-
Web Referencecert-portal.siemens.com