CVE-2020-36425

An issue was discovered in Arm Mbed TLS before 2.24.0. It incorrectly uses a revocationDate check when deciding whether to honor certificate revocatio...

Original description

The description as published by the source.

An issue was discovered in Arm Mbed TLS before 2.24.0. It incorrectly uses a revocationDate check when deciding whether to honor certificate revocation via a CRL. In some situations, an attacker can exploit this by changing the local clock.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2020-36425 mbedtls Fixed in: 2.16.9-0.1

References

advisory github.com
advisory github.com
advisory github.com
advisory github.com
advisory lists.debian.org
patch bugs.gentoo.org
report github.com