ARM mbedTLS version 2.7.0 and earlier contains a Ciphersuite Allows Incorrectly Signed Certificates vulnerability in mbedtls_ssl_get_verify_result() that can result in ECDSA-signed certificates are accepted, when only RSA-signed ones should be.. This attack appear to be exploitable via Peers negotiate a TLS-ECDH-RSA-* ciphersuite. Any of the peers can then provide an ECDSA-signed certificate, when only an RSA-signed one should be accepted..
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2018-06-26T16:00:00

Updated: 2024-08-05T12:40:47.241Z

Reserved: 2018-05-01T00:00:00

Link: CVE-2018-1000520

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2018-06-26T16:29:01.353

Modified: 2024-11-21T03:40:06.597

Link: CVE-2018-1000520

cve-icon Redhat

No data.