PT-2021-6687 · Mbed Tls+2 · Mbed Tls+2

Kfyatek · Published 2020-09-02 · Updated 2025-08-21 · CVE-2020-36476

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Mbed TLS versions prior to 2.24.0 Mbed TLS versions prior to 2.16.8 LTS Mbed TLS versions prior to 2.7.17 LTS

Description The issue is related to the missing zeroization of plaintext buffers in the mbedtls ssl read function, which fails to erase unused application data from memory. This could potentially allow a remote attacker to impact data integrity.

Recommendations For versions prior to 2.24.0, update to version 2.24.0 or later. For versions prior to 2.16.8 LTS, update to version 2.16.8 LTS or later. For versions prior to 2.7.17 LTS, update to version 2.7.17 LTS or later.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-212

CWE-668

Related Identifiers

ALT-PU-2020-2711

ALT-PU-2021-2234

ALT-PU-2025-10462

BDU:2022-02040

CVE-2020-36476

DLA-2826-1

DLA-3249-1

Affected Products

Alt Linux

Astra Linux

Mbed Tls

References · 21

• https://bdu.fstec.ru/vul/2022-02040 · Security Note
• https://osv.dev/vulnerability/CVE-2020-36476 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2826-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-36476 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-36476 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-36476 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36476 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-36476 · Security Note
• https://osv.dev/vulnerability/DLA-3249-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-36476 · Vendor Advisory
• https://github.com/ARMmbed/mbedtls/releases/tag/v2.7.17 · Note
• https://github.com/ARMmbed/mbedtls/releases/tag/v2.24.0 · Note
• https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.8 · Note
• https://github.com/ARMmbed/mbedtls/commit/ef73875913c66767e7a954aa0b68f42f0756d9b2 · Note
• https://github.com/ARMmbed/mbedtls/commit/a321413807927d6e295cec8677733bbde6aeec34 · Note