diff --git a/ChangeLog b/ChangeLog
index e50604d2a..e847b65bc 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -17,6 +17,9 @@ Bugfix
      encoded X509 CRLs. The overflow would enable maliciously constructed CRLs
      to bypass the version verification check. Found by Peng Li/Yueh-Hsun Lin,
      KNOX Security, Samsung Research America
+   * Fix a potential integer overflow in the version verification for DER
+     encoded X509 certificates. The overflow would enable maliciously
+     constructed certificates to bypass the certificate verification check.
 
 = mbed TLS 1.3.20 branch released 2017-06-21
 
diff --git a/library/x509_crt.c b/library/x509_crt.c
index 8fa63c5b2..2b3eef757 100644
--- a/library/x509_crt.c
+++ b/library/x509_crt.c
@@ -619,14 +619,14 @@ static int x509_crt_parse_der_core( x509_crt *crt, const unsigned char *buf,
         return( ret );
     }
 
-    crt->version++;
-
-    if( crt->version > 3 )
+    if( crt->version < 0 || crt->version > 2 )
     {
         x509_crt_free( crt );
         return( POLARSSL_ERR_X509_UNKNOWN_VERSION );
     }
 
+    crt->version++;
+
     if( ( ret = x509_get_sig_alg( &crt->sig_oid1, &sig_params1,
                                   &crt->sig_md, &crt->sig_pk,
                                   &crt->sig_opts ) ) != 0 )