CVE catalog

CVE-2017-14032

mbedtls: CVE-2017-14032

[CVE catalog]

Severity
High · CVSS 8.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.50% · Oct 25, 2026

ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates. NOTE: although mbed TLS was formerly known as PolarSSL, the releases shipped with the PolarSSL name are not affected.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianmbedtlssid3.6.7-3fixed
Debianmbedtlsforky3.6.7-3fixed
Debianmbedtlstrixie3.6.6-0.1~deb13u1fixed
Debianmbedtlsbookworm2.28.3-1fixed
Alpinembedtls3.102.6.0-r0fixed
Alpinembedtls3.112.6.0-r0fixed
Alpinembedtls3.122.6.0-r0fixed
Alpinembedtls3.132.6.0-r0fixed
Alpinembedtls3.142.6.0-r0fixed
Alpinembedtls3.152.6.0-r0fixed
Alpinembedtls3.162.6.0-r0fixed
Alpinembedtls3.172.6.0-r0fixed
Alpinembedtls3.182.6.0-r0fixed
Alpinembedtls3.192.6.0-r0fixed
Alpinembedtls3.202.6.0-r0fixed
Alpinembedtls3.212.6.0-r0fixed
Alpinembedtls3.222.6.0-r0fixed
Alpinembedtls3.232.6.0-r0fixed
Alpinembedtls3.242.6.0-r0fixed
Ubuntumbedtls16.042.1.2-1vulnerable
Ubuntumbedtls16.042.2.0-1vulnerable
Ubuntumbedtls16.042.2.1-1vulnerable
Ubuntumbedtls16.042.2.1-2vulnerable
Ubuntumbedtls16.042.2.1-2ubuntu0.1vulnerable
Ubuntumbedtls16.042.2.1-2ubuntu0.2fixed
Opensusembedtls-2tumbleweed2.27.0-1.2fixed
Susembedtlspackage hub 121.3.19-8.1fixed
Susembedtlspackage hub 121.3.19-8.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianmbedtlssourcesid2.6.0-1not yet assignedNot reported[873557]
Debianmbedtlssourceforky2.6.0-1not yet assignedNot reported[873557]
Debianmbedtlssourcetrixie2.6.0-1not yet assignedNot reported[873557]
Debianmbedtlssourcebookworm2.6.0-1not yet assignedNot reported[873557]
Alpinembedtlsapk3.102.6.0-r0Not reportedALPINE-CVE-2017-14032Not reported
Alpinembedtlsapk3.112.6.0-r0Not reportedALPINE-CVE-2017-14032Not reported
Alpinembedtlsapk3.122.6.0-r0Not reportedALPINE-CVE-2017-14032Not reported
Alpinembedtlsapk3.132.6.0-r0Not reportedALPINE-CVE-2017-14032Not reported
Alpinembedtlsapk3.142.6.0-r0Not reportedALPINE-CVE-2017-14032Not reported
Alpinembedtlsapk3.152.6.0-r0Not reportedALPINE-CVE-2017-14032Not reported
Alpinembedtlsapk3.162.6.0-r0Not reportedALPINE-CVE-2017-14032Not reported
Alpinembedtlsapk3.172.6.0-r0Not reportedALPINE-CVE-2017-14032Not reported
Alpinembedtlsapk3.182.6.0-r0Not reportedALPINE-CVE-2017-14032Not reported
Alpinembedtlsapk3.192.6.0-r0Not reportedALPINE-CVE-2017-14032Not reported
Alpinembedtlsapk3.202.6.0-r0Not reportedALPINE-CVE-2017-14032Not reported
Alpinembedtlsapk3.212.6.0-r0Not reportedALPINE-CVE-2017-14032Not reported
Alpinembedtlsapk3.222.6.0-r0Not reportedALPINE-CVE-2017-14032Not reported
Alpinembedtlsapk3.232.6.0-r0Not reportedALPINE-CVE-2017-14032Not reported
Alpinembedtlsapk3.242.6.0-r0Not reportedALPINE-CVE-2017-14032Not reported
Ubuntumbedtlsdeb16.042.2.1-2ubuntu0.2Not reportedUBUNTU-CVE-2017-14032Not reported
Opensusembedtls-2rpmtumbleweed2.27.0-1.2Not reportedOPENSUSE-SU-2024:11043-1Not reported
Susembedtlsrpmpackage hub 121.3.19-8.1Not reportedOPENSUSE-SU-2017:2736-1Not reported
Susembedtlsrpmpackage hub 121.3.19-8.1Not reportedOPENSUSE-SU-2017:2731-1Not reported

[Debian bug #873557]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [libmbedcrypto7]Unknown

    Source package: [mbedtls-2]

    Details (1)

    • 2.28.10-4.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.27.0-1.2

      Version impact unknown

      dsa · mbedtls-2 · opensuse · tumbleweed

  • [libmbedcrypto7-x86-64-v3]Unknown

    Source package: [mbedtls-2]

    Details (1)

    • 2.28.10-4.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.27.0-1.2

      Version impact unknown

      dsa · mbedtls-2 · opensuse · tumbleweed

  • [libmbedtls14]Unknown

    Source package: [mbedtls-2]

    Details (1)

    • 2.28.10-4.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.27.0-1.2

      Version impact unknown

      dsa · mbedtls-2 · opensuse · tumbleweed

  • [libmbedtls14-x86-64-v3]Unknown

    Source package: [mbedtls-2]

    Details (1)

    • 2.28.10-4.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.27.0-1.2

      Version impact unknown

      dsa · mbedtls-2 · opensuse · tumbleweed

  • [libmbedx509-1]Unknown

    Source package: [mbedtls-2]

    Details (1)

    • 2.28.10-4.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.27.0-1.2

      Version impact unknown

      dsa · mbedtls-2 · opensuse · tumbleweed

  • [libmbedx509-1-x86-64-v3]Unknown

    Source package: [mbedtls-2]

    Details (1)

    • 2.28.10-4.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.27.0-1.2

      Version impact unknown

      dsa · mbedtls-2 · opensuse · tumbleweed

  • [mbedtls-2-devel]Unknown

    Source package: [mbedtls-2]

    Details (1)

    • 2.28.10-4.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.27.0-1.2

      Version impact unknown

      dsa · mbedtls-2 · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [libmbedcrypto7]Fixed

    Source package: [mbedtls]

    Details (2)

    • 2.28.3-1 · amd64 · bookworm

      Fixed · Fixed: 2.6.0-1

      dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12

    • 2.28.3-1 · arm64 · bookworm

      Fixed · Fixed: 2.6.0-1

      dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12

  • [libmbedtls14]Fixed

    Source package: [mbedtls]

    Details (2)

    • 2.28.3-1 · amd64 · bookworm

      Fixed · Fixed: 2.6.0-1

      dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12

    • 2.28.3-1 · arm64 · bookworm

      Fixed · Fixed: 2.6.0-1

      dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12

  • [libmbedtls-dev]Fixed

    Source package: [mbedtls]

    Details (2)

    • 2.28.3-1 · amd64 · bookworm

      Fixed · Fixed: 2.6.0-1

      dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12

    • 2.28.3-1 · arm64 · bookworm

      Fixed · Fixed: 2.6.0-1

      dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12

  • [libmbedtls-doc]Fixed

    Source package: [mbedtls]

    Details (2)

    • 2.28.3-1 · all · bookworm

      Fixed · Fixed: 2.6.0-1

      dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12

    • 2.28.3-1 · all · bookworm

      Fixed · Fixed: 2.6.0-1

      dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12

  • [libmbedx509-1]Fixed

    Source package: [mbedtls]

    Details (2)

    • 2.28.3-1 · amd64 · bookworm

      Fixed · Fixed: 2.6.0-1

      dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12

    • 2.28.3-1 · arm64 · bookworm

      Fixed · Fixed: 2.6.0-1

      dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12

[Debian 13 (Trixie)]

  • [libmbedcrypto16]Fixed

    Source package: [mbedtls]

    Details (2)

    • 3.6.5-0.1~deb13u1 · amd64 · trixie

      Fixed · Fixed: 2.6.0-1

      dsa · mbedtls · debian · 13

    • 3.6.5-0.1~deb13u1 · arm64 · trixie

      Fixed · Fixed: 2.6.0-1

      dsa · mbedtls · debian · 13

  • [libmbedtls21]Fixed

    Source package: [mbedtls]

    Details (2)

    • 3.6.5-0.1~deb13u1 · amd64 · trixie

      Fixed · Fixed: 2.6.0-1

      dsa · mbedtls · debian · 13

    • 3.6.5-0.1~deb13u1 · arm64 · trixie

      Fixed · Fixed: 2.6.0-1

      dsa · mbedtls · debian · 13

  • [libmbedtls-dev]Fixed

    Source package: [mbedtls]

    Details (2)

    • 3.6.5-0.1~deb13u1 · amd64 · trixie

      Fixed · Fixed: 2.6.0-1

      dsa · mbedtls · debian · 13

    • 3.6.5-0.1~deb13u1 · arm64 · trixie

      Fixed · Fixed: 2.6.0-1

      dsa · mbedtls · debian · 13

  • [libmbedtls-doc]Fixed

    Source package: [mbedtls]

    Details (2)

    • 3.6.5-0.1~deb13u1 · all · trixie

      Fixed · Fixed: 2.6.0-1

      dsa · mbedtls · debian · 13

    • 3.6.5-0.1~deb13u1 · all · trixie

      Fixed · Fixed: 2.6.0-1

      dsa · mbedtls · debian · 13

  • [libmbedx509-7]Fixed

    Source package: [mbedtls]

    Details (2)

    • 3.6.5-0.1~deb13u1 · amd64 · trixie

      Fixed · Fixed: 2.6.0-1

      dsa · mbedtls · debian · 13

    • 3.6.5-0.1~deb13u1 · arm64 · trixie

      Fixed · Fixed: 2.6.0-1

      dsa · mbedtls · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]