Updated mbedtls packages fix security vulnerabilities
Publication date: 14 Feb 2024Modification date: 14 Feb 2024
Type: security
Affected Mageia releases : 9
Description
This update brings the mbedtls packages from 2.28.3 to the latest 2.28.7
release in the LTS branch, fixing a number of bugs as well the following
security vulnerabilities:
- Buffer overread in TLS stream cipher suites.
- Timing side channel in private key RSA operations.
- Buffer overflow in mbedtls_x509_set_extension.
See the linked release notes for details.
References
- https://bugs.mageia.org/show_bug.cgi?id=32844
- https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.4
- https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.5
- https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-2.28.5
- https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.6
- https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.7
- https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2023-10-1/
- https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-01-1/
- https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-01-2/
SRPMS
9/core
- mbedtls-2.28.7-1.mga9