CVE-2020-36425

Name	CVE-2020-36425
Description	An issue was discovered in Arm Mbed TLS before 2.24.0. It incorrectly uses a revocationDate check when deciding whether to honor certificate revocation via a CRL. In some situations, an attacker can exploit this by changing the local clock.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3249-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
mbedtls (PTS)	bullseye	2.16.9-0.1	fixed
	bullseye (security)	2.16.9-0.1+deb11u3	fixed
	bookworm	2.28.3-1	fixed
	forky, sid, trixie	3.6.4-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
mbedtls	source	buster	2.16.9-0~deb10u1		DLA-3249-1
mbedtls	source	(unstable)	2.16.9-0.1

[stretch] - mbedtls <no-dsa> (Minor issue)
https://github.com/ARMmbed/mbedtls/issues/3340
https://github.com/ARMmbed/mbedtls/pull/3433