ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates. NOTE: although mbed TLS was formerly known as PolarSSL, the releases shipped with the PolarSSL name are not affected.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote
    attackers to bypass peer authentication via an X.509 certificate chain with many intermediates. NOTE:
    although mbed TLS was formerly known as PolarSSL, the releases shipped with the PolarSSL name are not
    affected. (CVE-2017-14032)

This update for mbedtls fixes the following issues :

  - CVE-2017-14032: Possible authentication bypass of peer     based authentication when auth mode is configured as     'optional' (boo#1056544).

- Update to 2.6.0

Release notes:
https://tls.mbed.org/tech-updates/releases/mbedtls-2.6.0-2.1.9-and-1.3 .21-released

Security Advisory:
https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security
-advisory-2017-02

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An authentication bypass vulnerability was discovered in mbed TLS, a lightweight crypto and SSL/TLS library, when the authentication mode is configured as 'optional'. A remote attacker can take advantage of this flaw to mount a man-in-the-middle attack and impersonate an intended peer via an X.509 certificate chain with many intermediates.

ID	Name	Product	Family	Severity
426903	Alpine: multiple mbedtls2 packages: security update to 2.6.0-r0		Alpine Linux Local Security Checks	high
426903	Alpine: multiple mbedtls2 packages: security update to 2.6.0-r0		Alpine Linux Local Security Checks	high
424144	Alpine: multiple mbedtls packages: security update to 2.6.0-r0		Alpine Linux Local Security Checks	high
424144	Alpine: multiple mbedtls packages: security update to 2.6.0-r0		Alpine Linux Local Security Checks	high
400826	Alpine: multiple mbedtls packages: security update to 2.5.1-r0 (deprecated)		Alpine Linux Local Security Checks	high
400826	Alpine: multiple mbedtls packages: security update to 2.5.1-r0 (deprecated)		Alpine Linux Local Security Checks	high
104072	openSUSE Security Update : mbedtls (openSUSE-2017-1156)	Nessus	SuSE Local Security Checks	high
103100	Fedora 25 : mbedtls (2017-3abea58794)	Nessus	Fedora Local Security Checks	high
103096	Debian DSA-3967-1 : mbedtls - security update	Nessus	Debian Local Security Checks	high
102935	Fedora 26 : mbedtls (2017-382c240580)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2017-14032

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high