CVE-2017-14032

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2017-08-30T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates. NOTE: although mbed TLS was formerly known as PolarSSL, the releases shipped with the PolarSSL name are not affected."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-11-07T10:57:01.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "DSA-3967", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2017/dsa-3967"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-02"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ARMmbed/mbedtls/commit/31458a18788b0cf0b722acda9bb2f2fe13a3fb32"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ARMmbed/mbedtls/commit/d15795acd5074e0b44e71f7ede8bdfe1b48591fc"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugs.debian.org/873557"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2017-14032", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates. NOTE: although mbed TLS was formerly known as PolarSSL, the releases shipped with the PolarSSL name are not affected."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "DSA-3967", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2017/dsa-3967"}, {"name": "https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-02", "refsource": "CONFIRM", "url": "https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-02"}, {"name": "https://github.com/ARMmbed/mbedtls/commit/31458a18788b0cf0b722acda9bb2f2fe13a3fb32", "refsource": "CONFIRM", "url": "https://github.com/ARMmbed/mbedtls/commit/31458a18788b0cf0b722acda9bb2f2fe13a3fb32"}, {"name": "https://github.com/ARMmbed/mbedtls/commit/d15795acd5074e0b44e71f7ede8bdfe1b48591fc", "refsource": "CONFIRM", "url": "https://github.com/ARMmbed/mbedtls/commit/d15795acd5074e0b44e71f7ede8bdfe1b48591fc"}, {"name": "https://bugs.debian.org/873557", "refsource": "CONFIRM", "url": "https://bugs.debian.org/873557"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T19:13:41.938Z"}, "title": "CVE Program Container", "references": [{"name": "DSA-3967", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2017/dsa-3967"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-02"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/ARMmbed/mbedtls/commit/31458a18788b0cf0b722acda9bb2f2fe13a3fb32"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/ARMmbed/mbedtls/commit/d15795acd5074e0b44e71f7ede8bdfe1b48591fc"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugs.debian.org/873557"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2017-14032", "datePublished": "2017-08-30T20:00:00.000Z", "dateReserved": "2017-08-30T00:00:00.000Z", "dateUpdated": "2024-08-05T19:13:41.938Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:arm:mbed_tls:1.3.19:*:*:*:*:*:*:*", "matchCriteriaId": "CF762122-64BC-4A1A-A26D-81C1270541A5", "vulnerable": true}, {"criteria": "cpe:2.3:a:arm:mbed_tls:1.3.21:*:*:*:*:*:*:*", "matchCriteriaId": "4A8956C8-6CF0-4C37-84F9-8A89726806C3", "vulnerable": true}, {"criteria": "cpe:2.3:a:arm:mbed_tls:2.1.7:*:*:*:*:*:*:*", "matchCriteriaId": "3CF6E05C-E6E5-40B8-AFEA-A5ED937F5439", "vulnerable": true}, {"criteria": "cpe:2.3:a:arm:mbed_tls:2.1.9:*:*:*:*:*:*:*", "matchCriteriaId": "6F9D24F0-3892-417F-9C3A-CACEF00C2293", "vulnerable": true}, {"criteria": "cpe:2.3:a:arm:mbed_tls:2.4.2:*:*:*:*:*:*:*", "matchCriteriaId": "70407352-624A-40E6-82E4-7B4FAFE0C0DE", "vulnerable": true}, {"criteria": "cpe:2.3:a:arm:mbed_tls:2.6.2:*:*:*:*:*:*:*", "matchCriteriaId": "FD1F7803-31F3-40A9-A878-FDC757FCE83F", "vulnerable": true}, {"criteria": "cpe:2.3:a:trustedfirmware:mbed_tls:1.3.10:*:*:*:*:*:*:*", "matchCriteriaId": "CFD4C541-33FE-4923-8A4D-39766AE87BB9", "vulnerable": true}, {"criteria": "cpe:2.3:a:trustedfirmware:mbed_tls:1.3.11:*:*:*:*:*:*:*", "matchCriteriaId": "69BC04FE-C8F2-4654-B2D6-53EEC1B2F83A", "vulnerable": true}, {"criteria": "cpe:2.3:a:trustedfirmware:mbed_tls:1.3.12:*:*:*:*:*:*:*", "matchCriteriaId": "F4464D4B-7FEB-4CC9-9DB1-04DDE9051EED", "vulnerable": true}, {"criteria": "cpe:2.3:a:trustedfirmware:mbed_tls:1.3.13:*:*:*:*:*:*:*", "matchCriteriaId": "7E7D145D-61AE-44A9-B25F-FA98813F3613", "vulnerable": true}, {"criteria": "cpe:2.3:a:trustedfirmware:mbed_tls:1.3.14:*:*:*:*:*:*:*", "matchCriteriaId": "0E1F87EF-E34C-4F5A-BBED-DC29C8269936", "vulnerable": true}, {"criteria": "cpe:2.3:a:trustedfirmware:mbed_tls:1.3.15:*:*:*:*:*:*:*", "matchCriteriaId": "521BE8C9-B8DC-4F03-B15C-311554C58A4D", "vulnerable": true}, {"criteria": "cpe:2.3:a:trustedfirmware:mbed_tls:1.3.16:*:*:*:*:*:*:*", "matchCriteriaId": "7FB19997-DF83-47CD-A3F8-3C5EDF7404ED", "vulnerable": true}, {"criteria": "cpe:2.3:a:trustedfirmware:mbed_tls:1.3.17:*:*:*:*:*:*:*", "matchCriteriaId": "7C133EAD-826E-4249-A6B3-0AF948D1F24D", "vulnerable": true}, {"criteria": "cpe:2.3:a:trustedfirmware:mbed_tls:1.3.18:*:*:*:*:*:*:*", "matchCriteriaId": "D7FA1A04-38DC-47FE-937F-C4D210ABDFAF", "vulnerable": true}, {"criteria": "cpe:2.3:a:trustedfirmware:mbed_tls:1.3.20:*:*:*:*:*:*:*", "matchCriteriaId": "6134D22A-542A-4E29-A65D-1FDE9B92FDD1", "vulnerable": true}, {"criteria": "cpe:2.3:a:trustedfirmware:mbed_tls:2.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "C9F4DEBA-1378-4F0B-9224-AF53589C52A4", "vulnerable": true}, {"criteria": "cpe:2.3:a:trustedfirmware:mbed_tls:2.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "F680E325-BD7A-4F11-B5BF-4D9FFA19D5BA", "vulnerable": true}, {"criteria": "cpe:2.3:a:trustedfirmware:mbed_tls:2.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "9D24C216-3F86-47BE-AB7B-929C454C3DC9", "vulnerable": true}, {"criteria": "cpe:2.3:a:trustedfirmware:mbed_tls:2.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "97725498-9C50-49B2-8E8A-74792DFA57C4", "vulnerable": true}, {"criteria": "cpe:2.3:a:trustedfirmware:mbed_tls:2.1.3:*:*:*:*:*:*:*", "matchCriteriaId": "2D055497-EB0E-44CE-8486-1349E8CA8A0D", "vulnerable": true}, {"criteria": "cpe:2.3:a:trustedfirmware:mbed_tls:2.1.4:*:*:*:*:*:*:*", "matchCriteriaId": "A9C8AAA7-5B37-45E1-B4FA-9E02D47E8CB1", "vulnerable": true}, {"criteria": "cpe:2.3:a:trustedfirmware:mbed_tls:2.1.5:*:*:*:*:*:*:*", "matchCriteriaId": "ABBF8250-8725-4E41-A264-464E2AB6FB1E", "vulnerable": true}, {"criteria": "cpe:2.3:a:trustedfirmware:mbed_tls:2.1.6:*:*:*:*:*:*:*", "matchCriteriaId": "2EE33C4E-66A1-4F94-BE54-156E92141BE6", "vulnerable": true}, {"criteria": "cpe:2.3:a:trustedfirmware:mbed_tls:2.1.8:*:*:*:*:*:*:*", "matchCriteriaId": "52ECBA47-F4C6-4CFA-A3E1-F49CBE90B5FF", "vulnerable": true}, {"criteria": "cpe:2.3:a:trustedfirmware:mbed_tls:2.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "0B830917-A9E8-4AAB-90E8-558BB090B4C7", "vulnerable": true}, {"criteria": "cpe:2.3:a:trustedfirmware:mbed_tls:2.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "369A51A5-978D-4B96-9316-7E8FE91209A2", "vulnerable": true}, {"criteria": "cpe:2.3:a:trustedfirmware:mbed_tls:2.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "EE93A048-A916-41B1-8856-BBB0D158C612", "vulnerable": true}, {"criteria": "cpe:2.3:a:trustedfirmware:mbed_tls:2.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "66AEDF8A-C554-41CF-B67C-D5049255D23B", "vulnerable": true}, {"criteria": "cpe:2.3:a:trustedfirmware:mbed_tls:2.5.1:*:*:*:*:*:*:*", "matchCriteriaId": "50FD1F3D-9FEC-40A3-9706-F11EF95508B0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates. NOTE: although mbed TLS was formerly known as PolarSSL, the releases shipped with the PolarSSL name are not affected."}, {"lang": "es", "value": "ARM mbed TLS en versiones anteriores a la 1.3.21 y en versiones 2.x anteriores a la 2.1.9, si se configura la autenticaci\u00f3n opcional, permite a los atacantes omitir la autenticaci\u00f3n Peer mediante una cadena de certificados X.509 con muchos intermediarios. NOTA: aunque mbed TLS se conoc\u00eda antes como PolarSSL, las versiones lanzadas con el nombre PolarSSL no est\u00e1n afectadas."}], "id": "CVE-2017-14032", "lastModified": "2026-06-17T01:05:28.520", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-08-30T20:29:00.337", "references": [{"source": "cve@mitre.org", "url": "http://www.debian.org/security/2017/dsa-3967"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://bugs.debian.org/873557"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/ARMmbed/mbedtls/commit/31458a18788b0cf0b722acda9bb2f2fe13a3fb32"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/ARMmbed/mbedtls/commit/d15795acd5074e0b44e71f7ede8bdfe1b48591fc"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-02"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2017/dsa-3967"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://bugs.debian.org/873557"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/ARMmbed/mbedtls/commit/31458a18788b0cf0b722acda9bb2f2fe13a3fb32"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/ARMmbed/mbedtls/commit/d15795acd5074e0b44e71f7ede8bdfe1b48591fc"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-02"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}