Certificate Revocation Flaw in Arm Mbed TLS
CVE-2020-36425
5.3MEDIUM
What is CVE-2020-36425?
A flaw in Arm Mbed TLS, prior to version 2.24.0, involves improper handling of certificate revocation checks, specifically with the revocationDate attribute. This vulnerability allows an attacker to exploit the system by altering the local clock, potentially undermining the trust established by certificate revocation lists (CRLs). As a consequence, the software may inadvertently accept expired or untrusted certificates, exposing applications to various security risks. Users are encouraged to upgrade to the latest versions to mitigate this issue.