CVE-2018-1000520: Improper Certificate Validation

ARM mbedTLS version 2.7.0 and earlier contains a Ciphersuite Allows Incorrectly Signed Certificates vulnerability in mbedtlssslgetverifyresult that can result in ECDSA-signed certificates are accepted, when only RSA-signed ones should be.. This attack appear to be exploitable via Peers negotiate ...

PT-2018-9417

Name of the Vulnerable Software and Affected Versions mbedTLS version 2.7.0 and earlier Description The issue allows incorrectly signed certificates, specifically accepting ECDSA-signed certificates when only RSA-signed ones should be accepted. This can occur when peers negotiate a TLS-ECDH-RSA-...