CVE-2020-36476

Katalog CVE

CVSS 7.5 · High EPSS 1,6%

Kerentanan Improper Removal of Sensitive Information Before Storage or Transfer pada arm mbed tls, debian linux. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Mbed TLS before 2.24.0 (and before 2.16.8 LTS and before 2.7.17 LTS). There is missing zeroization of plaintext buffers in mbedtls_ssl_read to erase unused application data from memory.

Rincian

Terbit di NVD

23 Agustus 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 74,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.8 release notes · advisory pihak ketiga
• https://github.com/ARMmbed/mbedtls/releases/tag/v2.24.0 release notes · advisory pihak ketiga
• https://github.com/ARMmbed/mbedtls/releases/tag/v2.7.17 release notes · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2021/11/msg00021.html mailing list · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html mailing list · advisory pihak ketiga