CVE-2020-36475

HIGH

ARM Mbed TLS < 2.7.18 - Denial of Service

Title source: rule

Description

An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). The calculations performed by mbedtls_mpi_exp_mod are not limited; thus, supplying overly large parameters could lead to denial of service when generating Diffie-Hellman key pairs.

References (6)

Scores

CVSS v3 7.5
EPSS 0.0098
EPSS Percentile 76.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Classification

CWE
CWE-131
Status published

Affected Products (9)

arm/mbed_tls < 2.7.18
siemens/logo\!_cmr2020_firmware < 2.2
siemens/logo\!_cmr2040_firmware < 2.2
siemens/simatic_rtu3031c_firmware
siemens/simatic_rtu3041c_firmware
siemens/simatic_rtu3030c_firmware
siemens/simatic_rtu3000c_firmware
debian/debian_linux
debian/debian_linux

Timeline

Published Aug 23, 2021
Tracked Since Feb 18, 2026