An issue was discovered in Mbed TLS through 3.6.5 and 4.x through 4.0.0. There is a NULL pointer dereference in distinguished name parsing that allows an attacker to write to address 0.
Weakness
The product dereferences a pointer that it expects to be valid but is NULL.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Mbed_tls | Trustedfirmware | 3.5.0 (including) | 3.6.6 (excluding) |
| Mbed_tls | Trustedfirmware | 4.0.0 (including) | 4.0.0 (including) |
| Mbedtls | Ubuntu | esm-apps/xenial | * |