{"schema_version":"1.9.0","id":"CVE-2017-14032","published":"2017-08-30T20:29:00.337Z","modified":"2026-08-27T08:18:17.758343Z","related":["openSUSE-SU-2017:2731-1","openSUSE-SU-2017:2736-1","openSUSE-SU-2024:11043-1","openSUSE-SU-2026:11119-1"],"details":"ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates. NOTE: although mbed TLS was formerly known as PolarSSL, the releases shipped with the PolarSSL name are not affected.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/Mbed-TLS/mbedtls","events":[{"introduced":"98864d5c0b154eda7aeb2c2bffe7e7e1c97424bc"},{"last_affected":"59ae96f167a19f4d04dc6db61f6587b37ccd429f"}],"database_specific":{"cpe":["cpe:2.3:a:arm:mbed_tls:1.3.19:*:*:*:*:*:*:*","cpe:2.3:a:arm:mbed_tls:1.3.21:*:*:*:*:*:*:*","cpe:2.3:a:arm:mbed_tls:2.1.7:*:*:*:*:*:*:*","cpe:2.3:a:arm:mbed_tls:2.1.9:*:*:*:*:*:*:*","cpe:2.3:a:arm:mbed_tls:2.4.2:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.3.19"},{"last_affected":"1.3.19"},{"introduced":"1.3.21"},{"last_affected":"1.3.21"},{"introduced":"2.1.7"},{"last_affected":"2.1.7"},{"introduced":"2.1.9"},{"last_affected":"2.1.9"},{"introduced":"2.4.2"},{"last_affected":"2.4.2"}],"source":"CPE_STRING"}}],"versions":["1.3.19","1.3.21","2.1.7","2.1.9","2.4.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-14032.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/mbed-tls/mbedtls","events":[{"introduced":"015e48df6e2f15275161012fbb2544ce0a84c752"},{"last_affected":"f2a597fa3dd1c7b15e0fee62f6932b253295803d"},{"fixed":"31458a18788b0cf0b722acda9bb2f2fe13a3fb32"},{"fixed":"d15795acd5074e0b44e71f7ede8bdfe1b48591fc"}],"database_specific":{"cpe":["cpe:2.3:a:trustedfirmware:mbed_tls:1.3.10:*:*:*:*:*:*:*","cpe:2.3:a:trustedfirmware:mbed_tls:1.3.11:*:*:*:*:*:*:*","cpe:2.3:a:trustedfirmware:mbed_tls:1.3.12:*:*:*:*:*:*:*","cpe:2.3:a:trustedfirmware:mbed_tls:1.3.13:*:*:*:*:*:*:*","cpe:2.3:a:trustedfirmware:mbed_tls:1.3.14:*:*:*:*:*:*:*","cpe:2.3:a:trustedfirmware:mbed_tls:1.3.15:*:*:*:*:*:*:*","cpe:2.3:a:trustedfirmware:mbed_tls:1.3.16:*:*:*:*:*:*:*","cpe:2.3:a:trustedfirmware:mbed_tls:1.3.17:*:*:*:*:*:*:*","cpe:2.3:a:trustedfirmware:mbed_tls:1.3.18:*:*:*:*:*:*:*","cpe:2.3:a:trustedfirmware:mbed_tls:1.3.20:*:*:*:*:*:*:*","cpe:2.3:a:trustedfirmware:mbed_tls:2.0.0:*:*:*:*:*:*:*","cpe:2.3:a:trustedfirmware:mbed_tls:2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:trustedfirmware:mbed_tls:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:trustedfirmware:mbed_tls:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:trustedfirmware:mbed_tls:2.1.3:*:*:*:*:*:*:*","cpe:2.3:a:trustedfirmware:mbed_tls:2.1.4:*:*:*:*:*:*:*","cpe:2.3:a:trustedfirmware:mbed_tls:2.1.5:*:*:*:*:*:*:*","cpe:2.3:a:trustedfirmware:mbed_tls:2.1.6:*:*:*:*:*:*:*","cpe:2.3:a:trustedfirmware:mbed_tls:2.1.8:*:*:*:*:*:*:*","cpe:2.3:a:trustedfirmware:mbed_tls:2.2.0:*:*:*:*:*:*:*","cpe:2.3:a:trustedfirmware:mbed_tls:2.2.1:*:*:*:*:*:*:*","cpe:2.3:a:trustedfirmware:mbed_tls:2.3.0:*:*:*:*:*:*:*","cpe:2.3:a:trustedfirmware:mbed_tls:2.4.0:*:*:*:*:*:*:*","cpe:2.3:a:trustedfirmware:mbed_tls:2.5.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.3.10"},{"last_affected":"1.3.10"},{"introduced":"1.3.11"},{"last_affected":"1.3.11"},{"introduced":"1.3.12"},{"last_affected":"1.3.12"},{"introduced":"1.3.13"},{"last_affected":"1.3.13"},{"introduced":"1.3.14"},{"last_affected":"1.3.14"},{"introduced":"1.3.15"},{"last_affected":"1.3.15"},{"introduced":"1.3.16"},{"last_affected":"1.3.16"},{"introduced":"1.3.17"},{"last_affected":"1.3.17"},{"introduced":"1.3.18"},{"last_affected":"1.3.18"},{"introduced":"1.3.20"},{"last_affected":"1.3.20"},{"introduced":"2.0.0"},{"last_affected":"2.0.0"},{"introduced":"2.1.0"},{"last_affected":"2.1.0"},{"introduced":"2.1.1"},{"last_affected":"2.1.1"},{"introduced":"2.1.2"},{"last_affected":"2.1.2"},{"introduced":"2.1.3"},{"last_affected":"2.1.3"},{"introduced":"2.1.4"},{"last_affected":"2.1.4"},{"introduced":"2.1.5"},{"last_affected":"2.1.5"},{"introduced":"2.1.6"},{"last_affected":"2.1.6"},{"introduced":"2.1.8"},{"last_affected":"2.1.8"},{"introduced":"2.2.0"},{"last_affected":"2.2.0"},{"introduced":"2.2.1"},{"last_affected":"2.2.1"},{"introduced":"2.3.0"},{"last_affected":"2.3.0"},{"introduced":"2.4.0"},{"last_affected":"2.4.0"},{"introduced":"2.5.1"},{"last_affected":"2.5.1"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["1.3.10","1.3.11","1.3.12","1.3.13","1.3.14","1.3.15","1.3.16","1.3.17","1.3.18","1.3.20","2.0.0","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.8","2.2.0","2.2.1","2.3.0","2.4.0","2.5.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-14032.json","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"23535954794933034125050730467064723164","length":2262},"id":"CVE-2017-14032-5602eaa3","signature_type":"Function","signature_version":"v1","source":"https://github.com/mbed-tls/mbedtls/commit/d15795acd5074e0b44e71f7ede8bdfe1b48591fc","target":{"file":"library/x509_crt.c","function":"mbedtls_x509_crt_verify_with_profile"}},{"deprecated":false,"digest":{"function_hash":"289384578258587814542314141494984662847","length":29159},"id":"CVE-2017-14032-68c67a00","signature_type":"Function","signature_version":"v1","source":"https://github.com/mbed-tls/mbedtls/commit/31458a18788b0cf0b722acda9bb2f2fe13a3fb32","target":{"file":"library/error.c","function":"mbedtls_strerror"}},{"deprecated":false,"digest":{"line_hashes":["132424573133338098880192509041644689350","136223290653824832292330108440460395254","71226695291420032423883403561819135480","207101480763087697553560554299684203715"],"threshold":0.9},"id":"CVE-2017-14032-77efa648","signature_type":"Line","signature_version":"v1","source":"https://github.com/mbed-tls/mbedtls/commit/31458a18788b0cf0b722acda9bb2f2fe13a3fb32","target":{"file":"library/error.c"}},{"deprecated":false,"digest":{"line_hashes":["297508082841507766207153074088620982985","193765838583188265181447748208443829958","246008029411467398700936916418902399106","170728984395405133853399714968408782878","271212138821117569378509030157638532529","246049324344814765838357334631555737022","229676348833666410348666480313748689668","86482101448153393178407467509000579557","57218658069997918038981807154574011405","220261421346282504819318476197674000641","111667703861368524557872296946491606464","86482101448153393178407467509000579557","57218658069997918038981807154574011405","220261421346282504819318476197674000641","13388456810314230906762838641713333140","315536337083492372142446775006730033251","4270419841222123167981624894377912134","289739310754905327002609558766051706047","86482101448153393178407467509000579557","33087967539940626196069781929922405868","51190541300378967937168735493507131995","218910488878099105102794744835010694097","215431577958695108769703273527304932472"],"threshold":0.9},"id":"CVE-2017-14032-f89e6dcf","signature_type":"Line","signature_version":"v1","source":"https://github.com/mbed-tls/mbedtls/commit/d15795acd5074e0b44e71f7ede8bdfe1b48591fc","target":{"file":"library/x509_crt.c"}}],"vanir_signatures_modified":"2026-08-27T08:18:17Z"}}],"references":[{"type":"ADVISORY","url":"http://www.debian.org/security/2017/dsa-3967"},{"type":"ADVISORY","url":"https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-02"},{"type":"FIX","url":"https://bugs.debian.org/873557"},{"type":"FIX","url":"https://github.com/ARMmbed/mbedtls/commit/31458a18788b0cf0b722acda9bb2f2fe13a3fb32"},{"type":"FIX","url":"https://github.com/ARMmbed/mbedtls/commit/d15795acd5074e0b44e71f7ede8bdfe1b48591fc"}],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:arm:mbed_tls:2.6.2:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"2.6.2"},{"last_affected":"2.6.2"}],"source":"CPE_STRING","vendor_product":"arm:mbed_tls"}]},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}