CVE-2017-14032 Auth bypass in n/a
Remote attackers can bypass peer authentication in mbed TLS when optional authentication is enabled, using crafted X.509 certificate chains.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-14032?
CVE-2017-14032 is a high-severity authentication bypass vulnerability in Arm Mbed Tls, published on 30 Aug 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates. NOTE: although mbed TLS was formerly known as PolarSSL, the releases shipped with the PolarSSL name are not affected.
Weakness: CWE-287
Which versions are affected by CVE-2017-14032?
It affects 2 products.
Linux distribution packages (2)
mbedtls SUSE:Package Hub 12 | All versions | 1.3.19-8.1 |
mbedtls SUSE:Package Hub 12 | All versions | 1.3.19-8.1 |
Products include Arm Mbed Tls, Trustedfirmware Mbed Tls.
How do I fix CVE-2017-14032?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2017-14032 being exploited?
There is no known exploitation of CVE-2017-14032 in the wild and no public exploit code.
Other vulnerabilities in Arm Mbed Tls
Sources
Also known as ALPINE-CVE-2017-14032, DEBIAN-CVE-2017-14032, DSA-3967-1, GHSA-6v28-r64j-r4w6, MGASA-2018-0038, UBUNTU-CVE-2017-14032 and 2 more.