CVE-2020-36478
mediumPriorität · verfolgen · 30EPSS 0.011 · 66. PerzentilDEEURUUSEPSS · bewertet 2026-10-27
An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). A NULL algorithm parameters entry looks identical to an array of REAL (size zero) and thus the certificate is considered valid. However, if the parameters do not match in any way, then the certificate should be considered invalid.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenLOGO! CMR2020siemens_psirt
Update to V2.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109800267/ - BehobenLOGO! CMR2040siemens_psirt
Update to V2.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109800267/ - BehobenSIMATIC RTU3010Csiemens_psirt
Update to V5.0.14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109810215/ - BehobenSIMATIC RTU3030Csiemens_psirt
Update to V5.0.14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109810215/ - BehobenSIMATIC RTU3031Csiemens_psirt
Update to V5.0.14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109810215/ - BehobenSIMATIC RTU3041Csiemens_psirt
Update to V5.0.14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109810215/ - BehobenLOGO! CMR2020cisa_csaf_ot
For the SIMATIC RTU 3000 family, Siemens recommends affected users use the certificate projection feature to pin the valid certificates of external servers providing services to the RTU/CMR devices. Refer to the product manual for further information.
- BehobenLOGO! CMR2040cisa_csaf_ot
For the SIMATIC RTU 3000 family, Siemens recommends affected users use the certificate projection feature to pin the valid certificates of external servers providing services to the RTU/CMR devices. Refer to the product manual for further information.
- BehobenSIMATIC RTU 3000 familycisa_csaf_ot
For the SIMATIC RTU 3000 family, Siemens recommends affected users use the certificate projection feature to pin the valid certificates of external servers providing services to the RTU/CMR devices. Refer to the product manual for further information.
- MitigationLOGO! CMR2020siemens_psirt
For CVE-2020-36478: Use the certificate projection feature to pin the valid certificates of external servers providing services to the RTU/CMR devices. See the manual for further information
- MitigationLOGO! CMR2040siemens_psirt
For CVE-2020-36478: Use the certificate projection feature to pin the valid certificates of external servers providing services to the RTU/CMR devices. See the manual for further information
- MitigationSIMATIC RTU3010Csiemens_psirt
For CVE-2020-36478: Use the certificate projection feature to pin the valid certificates of external servers providing services to the RTU/CMR devices. See the manual for further information
- MitigationSIMATIC RTU3030Csiemens_psirt
For CVE-2020-36478: Use the certificate projection feature to pin the valid certificates of external servers providing services to the RTU/CMR devices. See the manual for further information
- MitigationSIMATIC RTU3031Csiemens_psirt
For CVE-2020-36478: Use the certificate projection feature to pin the valid certificates of external servers providing services to the RTU/CMR devices. See the manual for further information
- MitigationSIMATIC RTU3041Csiemens_psirt
For CVE-2020-36478: Use the certificate projection feature to pin the valid certificates of external servers providing services to the RTU/CMR devices. See the manual for further information
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 5–7.5
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (31)
Betroffene Produkte und Versionsbereiche.
Advisories (2)
Hersteller- und Ökosystem-Meldungen dazu.
- SSA-756638SSA-756638: Vulnerabilities in Third-Party Component Mbed TLS of LOGO! CMR Family and SIMATIC RTU 3000 Family2021-09-14csaf · siemens_psirtDE
Devices of the LOGO! CMR family and the SIMATIC RTU 3000 family are affected by several vulnerabilities in the third party component Mbed TLS. They could allow an attacker with access to any of the interfaces of an affected device to impact the availability or to communicate with invalid certificates. Siemens has released updates for the affected products and recommends to update to the latest versions.
- ICSA-21-257-20Siemens LOGO! CMR and SIMATIC RTU 30002021-09-14icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow an attacker with access to any of the interfaces of an affected device to impact the availability or to communicate with invalid certificates.
auch bekannt als (4)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (26)
Externe Belege — Patches, Meldungen, Analysen.
- https://cert-portal.siemens.com/productcert/pdf/ssa-756638.pdfcnnvd
- https://github.com/ARMmbed/mbedtls/issues/3629cnnvd
- https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.9cnnvd
- https://github.com/ARMmbed/mbedtls/releases/tag/v2.25.0cnnvd
- https://github.com/ARMmbed/mbedtls/releases/tag/v2.7.18cnnvd
- https://lists.debian.org/debian-lts-announce/2021/11/msg00021.htmlcnnvd
- https://lists.debian.org/debian-lts-announce/2022/12/msg00036.htmlcnnvd
- https://packetstormsecurity.com/files/170461/Gentoo-Linux-Security-Advisory-202301-08.htmlcnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan