Certificate Verification Issue in Mbed TLS by ARM

CVE-2020-36477

Summary

A security issue in Mbed TLS prior to version 2.24.0 compromises the verification of X.509 certificates. The vulnerability occurs when comparing expected names to actual certificate names while handling the subjectAltName extension. If the subjecAltName extension is utilized, the verification process incorrectly allows an attacker to impersonate a domain by manipulating the 4-byte or 16-byte representation tied to an IPv4 or IPv6 address. The attacker must control the relevant IP address to exploit this flaw.

References