PT-2020-6619 · Mbed Tls+1 · Mbed Tls+1

Kfyatek · Published 2020-07-17 · Updated 2025-08-21 · CVE-2020-36477

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Mbed TLS versions prior to 2.24.0

Description An issue in the verification of X.509 certificates allows an attacker to impersonate a domain by getting a certificate for the corresponding IPv4 or IPv6 address, provided they control that IP address. The problem arises when the subjectAltName extension is present, and the expected name is compared to any name in that extension regardless of its type.

Recommendations For versions prior to 2.24.0, update to version 2.24.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the mbedtls x509 crt verify function until a patch is available. Avoid using the cn argument of mbedtls x509 crt verify with certificates that have a subjectAltName extension until the issue is resolved.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

ALT-PU-2020-2711

ALT-PU-2021-2234

ALT-PU-2025-10462

BDU:2022-01651

CVE-2020-36477

Affected Products

Alt Linux

Mbed Tls

References · 15

• https://osv.dev/vulnerability/CVE-2020-36477 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-36477 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-36477 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36477 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-36477 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-36477 · Security Note
• https://bdu.fstec.ru/vul/2022-01651 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-36477 · Vendor Advisory
• https://security.gentoo.org/glsa/202301-08 · Vendor Advisory
• https://github.com/ARMmbed/mbedtls/issues/3498 · Note
• https://github.com/ARMmbed/mbedtls/releases/tag/v2.24.0 · Note
• https://github.com/ARMmbed/mbedtls/commit/f3e4bd8632b71dc491e52e6df87dc3e409d2b869 · Note
• https://xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.6 · Note
• https://t.me/cvenotify/20225 · Telegram Post
• https://t.me/cvenotify/19881 · Telegram Post