high7.5
CVE-2020-36475
An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS).
Impact
An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). The calculations performed by mbedtls_mpi_exp_mod are not limited; thus, supplying overly large parameters could lead to denial of service when generating Diffie-Hellman key pairs.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Arm | Mbed Tls | before 2.7.18 from 2.8.0 before 2.16.9 from 2.17.0 before 2.25.0 |
| Siemens | Logo\! Cmr2020 Firmware | before 2.2 |
| Siemens | Logo\! Cmr2040 Firmware | before 2.2 |
| Siemens | Simatic Rtu3031c Firmware | All versions |
| Siemens | Simatic Rtu3041c Firmware | All versions |
| Siemens | Simatic Rtu3030c Firmware | All versions |
| Siemens | Simatic Rtu3000c Firmware | All versions |
| Debian | Debian Linux | Versions 9.0, 10.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://cert-portal.siemens.com/productcert/pdf/ssa-756638.pdf
- https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.9
- https://github.com/ARMmbed/mbedtls/releases/tag/v2.25.0
- https://github.com/ARMmbed/mbedtls/releases/tag/v2.7.18
- https://lists.debian.org/debian-lts-announce/2021/11/msg00021.html
- https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-756638.pdf
- https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.9
- https://github.com/ARMmbed/mbedtls/releases/tag/v2.25.0
- https://github.com/ARMmbed/mbedtls/releases/tag/v2.7.18
- https://lists.debian.org/debian-lts-announce/2021/11/msg00021.html
- https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html