CVE-2020-36476 | BDVDB-2026-159273 Detail

Description#

An issue was discovered in Mbed TLS before 2.24.0 (and before 2.16.8 LTS and before 2.7.17 LTS). There is missing zeroization of plaintext buffers in mbedtls_ssl_read to erase unused application data from memory.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://github.com/ARMmbed/mbedtls/releases/tag/v2.7.17
https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.8
https://github.com/ARMmbed/mbedtls/releases/tag/v2.24.0
https://lists.debian.org/debian-lts-announce/2021/11/msg00021.html
https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html

Exploit#

No public exploit known

History#

Version 12021-08-23Record published in the CVE List.
Version 22024-08-04Most recent update recorded in the CVE List.