CVE-2020-36477

An issue was discovered in Mbed TLS before 2.24.0. The verification of X.509 certificates when matching the expected common name (the cn argument of mbedtls_x509_crt_verify) with the actual certificate name is mishandled: when the subjecAltName extension is present, the expected name is compared to any name in that extension regardless of its type. This means that an attacker could impersonate a 4-byte or 16-byte domain by getting a certificate for the corresponding IPv4 or IPv6 address (this would require the attacker to control that IP address, though).

• CWE-295

• https://github.com/ARMmbed/mbedtls/issues/3498Third Party Advisory
• https://github.com/ARMmbed/mbedtls/releases/tag/v2.24.0Release Notes, Third Party Advisory
• https://security.gentoo.org/glsa/202301-08Third Party Advisory
• https://github.com/ARMmbed/mbedtls/issues/3498Third Party Advisory
• https://github.com/ARMmbed/mbedtls/releases/tag/v2.24.0Release Notes, Third Party Advisory
• https://security.gentoo.org/glsa/202301-08Third Party Advisory

Published

Aug 23, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-36471An issue was discovered in the generator crate before 0.7.0 …5.9
• CVE-2020-36472An issue was discovered in the max7301 crate before 0.2.0 fo…5.9
• CVE-2020-36473UCWeb UC 12.12.3.1219 through 12.12.3.1226 uses cleartext HT…3.7
• CVE-2020-36474SafeCurl before 0.9.2 has a DNS rebinding vulnerability.9.8
• CVE-2020-36475An issue was discovered in Mbed TLS before 2.25.0 (and befor…7.5
• CVE-2020-36476An issue was discovered in Mbed TLS before 2.24.0 (and befor…7.5
• CVE-2020-36478An issue was discovered in Mbed TLS before 2.25.0 (and befor…7.5
• CVE-2020-3648u'Possible out of bound write in DSP driver code due to lack…7.8
• CVE-2020-36485Portable Ltd Playable v9.18 was discovered to contain an arb…7.8
• CVE-2020-36486Swift File Transfer Mobile v1.1.2 and below was discovered t…6.1
• CVE-2020-36488An issue in the FTP server of Sky File v2.1.0 allows attacke…6.5
• CVE-2020-36489Dropouts Technologies LLP Air Share v1.2 was discovered to c…5.4