PT-2021-6686 · Mbed Tls+2 · Mbed Tls+2

Published 2020-12-12 · Updated 2025-08-21 · CVE-2020-36478

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Mbed TLS versions prior to 2.25.0 Mbed TLS versions prior to 2.16.9 LTS Mbed TLS versions prior to 2.7.18 LTS

Description The issue is related to an incorrect comparison of NULL with an empty array in the implementation of TLS and SSL protocols in Mbed TLS. This allows a remote attacker to compromise data integrity. The problem arises when a NULL algorithm parameters entry is mistaken for an array of size zero, causing a certificate to be considered valid even if the parameters do not match.

Recommendations For Mbed TLS versions prior to 2.25.0, update to version 2.25.0 or later. For Mbed TLS versions prior to 2.16.9 LTS, update to version 2.16.9 LTS or later. For Mbed TLS versions prior to 2.7.18 LTS, update to version 2.7.18 LTS or later.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

ALT-PU-2020-3502

ALT-PU-2021-2234

ALT-PU-2025-10462

BDU:2022-02039

CVE-2020-36478

DLA-2826-1

DLA-3249-1

Affected Products

Alt Linux

Astra Linux

Mbed Tls

References · 23

• 🔥 https://github.com/ARMmbed/mbedtls/issues/3629 · Exploit
• https://cert-portal.siemens.com/productcert/pdf/ssa-756638.pdf · Patch
• https://bdu.fstec.ru/vul/2022-02039 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-36478 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-36478 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2826-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-36478 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-36478 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36478 · Security Note
• https://osv.dev/vulnerability/DLA-3249-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-36478 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-36478 · Security Note
• https://github.com/ARMmbed/mbedtls/releases/tag/v2.7.18 · Note
• https://github.com/ARMmbed/mbedtls/releases/tag/v2.25.0 · Note
• https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.9 · Note