Information Exposure Affecting armmbed/mbedtls package, versions [,2.7.17)[2.8.0,2.16.8)[2.17.0,2.24.0)


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.38% (73rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UNMANAGED-ARMMBEDMBEDTLS-2368689
  • published26 Jan 2022
  • disclosed23 Aug 2021
  • creditUnknown

Introduced: 23 Aug 2021

CVE-2020-36476  (opens in a new tab)
CWE-668  (opens in a new tab)

How to fix?

Upgrade armmbed/mbedtls to version 2.7.17, 2.16.8, 2.24.0 or higher.

Overview

Affected versions of this package are vulnerable to Information Exposure. An issue was discovered in Mbed TLS before 2.24.0 (and before 2.16.8 LTS and before 2.7.17 LTS). There is missing zeroization of plaintext buffers in mbedtls_ssl_read to erase unused application data from memory.

CVSS Scores

version 3.1