ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates. NOTE: although mbed TLS was formerly known as PolarSSL, the releases shipped with the PolarSSL name are not affected.

This update for mbedtls fixes the following issues :

  - CVE-2017-14032: Possible authentication bypass of peer     based authentication when auth mode is configured as     'optional' (boo#1056544).

- Update to 2.6.0

Release notes:
https://tls.mbed.org/tech-updates/releases/mbedtls-2.6.0-2.1.9-and-1.3 .21-released

Security Advisory:
https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security
-advisory-2017-02

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An authentication bypass vulnerability was discovered in mbed TLS, a lightweight crypto and SSL/TLS library, when the authentication mode is configured as 'optional'. A remote attacker can take advantage of this flaw to mount a man-in-the-middle attack and impersonate an intended peer via an X.509 certificate chain with many intermediates.

ID	Name	Product	Family	Severity
104072	openSUSE Security Update : mbedtls (openSUSE-2017-1156)	Nessus	SuSE Local Security Checks	high
103100	Fedora 25 : mbedtls (2017-3abea58794)	Nessus	Fedora Local Security Checks	high
103096	Debian DSA-3967-1 : mbedtls - security update	Nessus	Debian Local Security Checks	high
102935	Fedora 26 : mbedtls (2017-382c240580)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2017-14032

high

Tenable Plugins

high

high

high

high