CVE-2017-14032 (GCVE-0-2017-14032)
Vulnerability from cvelistv5
Published
2017-08-30 20:00
Modified
2024-08-05 19:13
Severity ?
CWE
  • n/a
Summary
ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates. NOTE: although mbed TLS was formerly known as PolarSSL, the releases shipped with the PolarSSL name are not affected.
References
cve@mitre.orghttp://www.debian.org/security/2017/dsa-3967
cve@mitre.orghttps://bugs.debian.org/873557Issue Tracking, Patch, Third Party Advisory
cve@mitre.orghttps://github.com/ARMmbed/mbedtls/commit/31458a18788b0cf0b722acda9bb2f2fe13a3fb32Issue Tracking, Patch, Third Party Advisory
cve@mitre.orghttps://github.com/ARMmbed/mbedtls/commit/d15795acd5074e0b44e71f7ede8bdfe1b48591fcIssue Tracking, Patch, Third Party Advisory
cve@mitre.orghttps://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-02Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2017/dsa-3967
af854a3a-2127-422b-91ae-364da2661108https://bugs.debian.org/873557Issue Tracking, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/ARMmbed/mbedtls/commit/31458a18788b0cf0b722acda9bb2f2fe13a3fb32Issue Tracking, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/ARMmbed/mbedtls/commit/d15795acd5074e0b44e71f7ede8bdfe1b48591fcIssue Tracking, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-02Vendor Advisory
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T19:13:41.938Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-3967",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2017/dsa-3967"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-02"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/ARMmbed/mbedtls/commit/31458a18788b0cf0b722acda9bb2f2fe13a3fb32"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/ARMmbed/mbedtls/commit/d15795acd5074e0b44e71f7ede8bdfe1b48591fc"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugs.debian.org/873557"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-08-30T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates. NOTE: although mbed TLS was formerly known as PolarSSL, the releases shipped with the PolarSSL name are not affected."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-11-07T10:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "DSA-3967",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2017/dsa-3967"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-02"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/ARMmbed/mbedtls/commit/31458a18788b0cf0b722acda9bb2f2fe13a3fb32"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/ARMmbed/mbedtls/commit/d15795acd5074e0b44e71f7ede8bdfe1b48591fc"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugs.debian.org/873557"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-14032",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates. NOTE: although mbed TLS was formerly known as PolarSSL, the releases shipped with the PolarSSL name are not affected."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "DSA-3967",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2017/dsa-3967"
            },
            {
              "name": "https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-02",
              "refsource": "CONFIRM",
              "url": "https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-02"
            },
            {
              "name": "https://github.com/ARMmbed/mbedtls/commit/31458a18788b0cf0b722acda9bb2f2fe13a3fb32",
              "refsource": "CONFIRM",
              "url": "https://github.com/ARMmbed/mbedtls/commit/31458a18788b0cf0b722acda9bb2f2fe13a3fb32"
            },
            {
              "name": "https://github.com/ARMmbed/mbedtls/commit/d15795acd5074e0b44e71f7ede8bdfe1b48591fc",
              "refsource": "CONFIRM",
              "url": "https://github.com/ARMmbed/mbedtls/commit/d15795acd5074e0b44e71f7ede8bdfe1b48591fc"
            },
            {
              "name": "https://bugs.debian.org/873557",
              "refsource": "CONFIRM",
              "url": "https://bugs.debian.org/873557"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-14032",
    "datePublished": "2017-08-30T20:00:00",
    "dateReserved": "2017-08-30T00:00:00",
    "dateUpdated": "2024-08-05T19:13:41.938Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2017-14032\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2017-08-30T20:29:00.337\",\"lastModified\":\"2025-04-20T01:37:25.860\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates. NOTE: although mbed TLS was formerly known as PolarSSL, the releases shipped with the PolarSSL name are not affected.\"},{\"lang\":\"es\",\"value\":\"ARM mbed TLS en versiones anteriores a la 1.3.21 y en versiones 2.x anteriores a la 2.1.9, si se configura la autenticaci\u00f3n opcional, permite a los atacantes omitir la autenticaci\u00f3n Peer mediante una cadena de certificados X.509 con muchos intermediarios. NOTA: aunque mbed TLS se conoc\u00eda antes como PolarSSL, las versiones lanzadas con el nombre PolarSSL no est\u00e1n afectadas.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:P/A:P\",\"baseScore\":6.8,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-287\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:1.3.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"28621156-2430-447B-8816-47B0FB58245B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:1.3.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E11BBB2C-0423-47B1-AE12-EB849E17BAF6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:1.3.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4131CE76-6260-412C-A6A6-20B0E978E569\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:1.3.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE92D8F7-5705-47B6-B2C2-9DE6C7880647\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:1.3.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EA50C256-2054-4661-9C42-D31D7D87BAF7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:1.3.15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7791D4E9-3FEE-42DA-B320-CF7188A10294\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:1.3.16:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BE415DAA-A89F-4204-AC2C-577FCB447E4B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:1.3.17:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"95F691DB-9552-4EBB-B29D-16658561FA4B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:1.3.18:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F1547B2A-E0D5-41D1-9449-1CCF35022B0E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:1.3.19:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CF762122-64BC-4A1A-A26D-81C1270541A5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:1.3.20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"59D6B559-5F99-4E38-A861-3AB8A7D2E6BB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:1.3.21:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4A8956C8-6CF0-4C37-84F9-8A89726806C3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:2.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B395D81-876F-43FC-8DB9-44377647A37A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:2.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F92622F1-82DA-4819-8275-06DC9DBE1BA1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:2.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5871FDE9-02D0-466C-BDB7-90A14C4F637E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:2.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FE6B4875-3FC3-499F-A76B-2D04982F743A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:2.1.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B3B67842-5AFA-459F-9CCF-772B9DC7139F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:2.1.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AD0500EE-52C0-4896-B3D8-5BE731D66039\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:2.1.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"015739E9-C0E3-4A62-BB9D-FA836BFD4351\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:2.1.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"842B0D15-6A3D-4CEE-AD02-49B0436E78E4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:2.1.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3CF6E05C-E6E5-40B8-AFEA-A5ED937F5439\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:2.1.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D4133C86-70E0-44FD-BBDB-D61EFB31F027\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:2.1.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6F9D24F0-3892-417F-9C3A-CACEF00C2293\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:2.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8911513E-968C-403E-9D00-2DC0AA82F99B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:2.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"48D98945-82BB-4954-AA6D-7D98E4CE1154\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:2.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6378C1CC-7C8F-47E3-A1A7-CDEC76E4CBE4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:2.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"525190A3-2194-4E4E-9D34-0048583B9C42\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:2.4.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"70407352-624A-40E6-82E4-7B4FAFE0C0DE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:2.5.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DD52988E-4B2F-41AF-BC25-F38F87D9B8C4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:2.6.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FD1F7803-31F3-40A9-A878-FDC757FCE83F\"}]}]}],\"references\":[{\"url\":\"http://www.debian.org/security/2017/dsa-3967\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://bugs.debian.org/873557\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/ARMmbed/mbedtls/commit/31458a18788b0cf0b722acda9bb2f2fe13a3fb32\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/ARMmbed/mbedtls/commit/d15795acd5074e0b44e71f7ede8bdfe1b48591fc\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-02\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.debian.org/security/2017/dsa-3967\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://bugs.debian.org/873557\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/ARMmbed/mbedtls/commit/31458a18788b0cf0b722acda9bb2f2fe13a3fb32\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/ARMmbed/mbedtls/commit/d15795acd5074e0b44e71f7ede8bdfe1b48591fc\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-02\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.