Skip to contentSkip to conversation

mbdedtls: security bump to version 2.9.0

PATCH New Fabrice Fontaine 2 participants 2 messages May 19, 2018

lore
Share & tools
lore

Fabrice Fontaine

author
#0 lore raw

PATCH 1/1 mbdedtls: security bump to version 2.9.0

Extract from release announcement:

- (2.9, 2.7, 2.1) Fixed an issue in the X.509 module which could lead to a buffer overread during certificate validation. Additionally, the issue could also lead to unnecessary callback checks being made or to some validation checks to be omitted. The overread could be triggered remotely, while the other issues would require a non DER-compliant certificate to be correctly signed by a trusted CA, or a trusted CA with a non DER-compliant certificate. Found by luocm. Fixes #825.

- (2.9, 2.7, 2.1) Fixed the buffer length assertion in the ssl_parse_certificate_request() function which could lead to an arbitrary overread of the message buffer. The overreads could be caused by receiving a malformed algorithms section which was too short. In builds with debug output, this overread data was output with the debug data.

- (2.9, 2.7, 2.1) Fixed a client-side bug in the validation of the server's ciphersuite choice which could potentially lead to the client accepting a ciphersuite it didn't offer or a ciphersuite that could not be used with the TLS or DTLS version chosen by the server. This could lead to corruption of internal data structures for some configurations.

Signed-off-by Fabrice Fontaine <[email protected]>
---
 package/mbedtls/mbedtls.hash | 6 +++---
 package/mbedtls/mbedtls.mk   | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)
package/mbedtls/mbedtls.hash +3 -3
index f5331bed15..b94a671239 100644
@@ -1,5 +1,5 @@
-# From https://tls.mbed.org/tech-updates/releases/mbedtls-2.8.0-2.7.2-and-2.1.11-released
-sha1	e36d7cbdc2ed0a5d5659385840e8fbb4d351234e	mbedtls-2.7.2-apache.tgz
-sha256	fd38c2bb5fbe1ffd3e7fdcdd71130986f2010f25b3a5575eb8ded0dd3bc573d7	mbedtls-2.7.2-apache.tgz
+# From https://tls.mbed.org/tech-updates/releases/mbedtls-2.9.0-2.7.3-and-2.1.12-released
+sha1	e87dbb46bbe050c1978dc07fb7f1c709ac6314f7	mbedtls-2.9.0-apache.tgz
+sha256	a06a9b43e583b7e6707becfeeb13d88ed00f25fee31a5386cb3a3014c454bad8	mbedtls-2.9.0-apache.tgz
 # Locally calculated
 sha256	cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30	apache-2.0.txt
package/mbedtls/mbedtls.mk +1 -1
index ca44ee3713..aa199c831a 100644
@@ -5,7 +5,7 @@
 ################################################################################
 
 MBEDTLS_SITE = https://tls.mbed.org/code/releases
-MBEDTLS_VERSION = 2.7.2
+MBEDTLS_VERSION = 2.9.0
 MBEDTLS_SOURCE = mbedtls-$(MBEDTLS_VERSION)-apache.tgz
 MBEDTLS_CONF_OPTS = \
 	-DENABLE_PROGRAMS=$(if $(BR2_PACKAGE_MBEDTLS_PROGRAMS),ON,OFF) \
Signature · 1 line
2.14.1
#1 lore raw

PATCH 1/1 mbdedtls: security bump to version 2.9.0

Hello,

package/mbedtls/mbedtls.mk line 8

Quoted 3 lines · Fabrice Fontaine

MBEDTLS_SITE = https://tls.mbed.org/code/releases

package/mbedtls/mbedtls.mk +1 -1
-MBEDTLS_VERSION = 2.7.2
+MBEDTLS_VERSION = 2.9.0

For master, I think it would make more sense to update to 2.7.3, which fixes the same security issues. See
https://tls.mbed.org/tech-updates/releases/mbedtls-2.9.0-2.7.3-and-2.1.12-released.

Thanks,

Thomas

Signature · 3 lines
Thomas Petazzoni, CTO, Bootlin (formerly Free Electrons)
Embedded Linux and Kernel engineering
https://bootlin.com