SB2025032526 - Multiple vulnerabilities in Mbed TLS

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Improper certificate validation (CVE-ID: CVE-2025-27809)

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists within the client authentication process during certificate-based authentication. Due to insecure default behavior,  if a TLS client application does not call mbedtls_ssl_set_hostname(), the server verification step is skipped. As a result, a remote attacker can supply any valid certificate signed by a trusted CA and perform MitM attack.

2) Improper authentication (CVE-ID: CVE-2025-27810)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error when handling memory allocations during TLS handshake. A remote attacker with ability to trigger memory allocation failures or cryptographic hardware failures can impersonate a legitimate peer by tampering with handshake messages.

Remediation

Install update from vendor's website.

References

• https://github.com/ARMmbed/mbedtls/releases/tag/mbedtls-2.28.10
• https://github.com/ARMmbed/mbedtls/releases/tag/mbedtls-3.6.3
• https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-03-1/
• https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-03-2/