CVE-2020-36478

An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). A NULL algorithm parameters entry looks identical to...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). A NULL algorithm parameters entry looks identical to an array of REAL (size zero) and thus the certificate is considered valid. However, if the parameters do not match in any way, then the certificate should be considered invalid.

出典: OSV.dev (Open Source Vulnerabilities) NVD OSV

ディストリビューション別の修正状況

各ディストリビューションが公開している、この CVE の修正パッケージ

Debian DEBIAN-CVE-2020-36478 mbedtls 修正版: 2.16.9-0.1

参照URL

advisory github.com
advisory github.com
advisory github.com
advisory lists.debian.org
advisory lists.debian.org
patch cert-portal.siemens.com
report github.com