Advisories » MGASA-2020-0370

Updated mbedtls packages fix security vulnerabilities

Publication date: 27 Sep 2020
Modification date: 21 Sep 2020
Type: security
Affected Mageia releases : 7
CVE: CVE-2020-16150

Description

mbedtls 2.16.8 fixes three security vulnerabilities which could affect earlier
releases:

Local side channel attack on classical CBC decryption in (D)TLS
(CVE-2020-16150).

Local side channel attack on RSA and static Diffie-Hellman.

Protocol weakness in DHE-PSK key exchange.
                

References

• https://bugs.mageia.org/show_bug.cgi?id=27282
• https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-09-1
• https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-09-2
• https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-09-3
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16150

SRPMS

7/core

• mbedtls-2.16.8-1.mga7