CVE-2018-1000520 — Improper Certificate Validation in ARM Mbed TLS
Severity
7.5HIGHNVD
EPSS
0.1%
top 81.45%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJun 26
Latest updateMay 13
Description
ARM mbedTLS version 2.7.0 and earlier contains a Ciphersuite Allows Incorrectly Signed Certificates vulnerability in mbedtls_ssl_get_verify_result() that can result in ECDSA-signed certificates are accepted, when only RSA-signed ones should be.. This attack appear to be exploitable via Peers negotiate a TLS-ECDH-RSA-* ciphersuite. Any of the peers can then provide an ECDSA-signed certificate, when only an RSA-signed one should be accepted..
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6
Affected Packages1 packages
🔴Vulnerability Details
3📋Vendor Advisories
1Debianâ–¶
CVE-2018-1000520: mbedtls - ARM mbedTLS version 2.7.0 and earlier contains a Ciphersuite Allows Incorrectly ...↗2018