Debian Package Tracker
Register | Log in
Subscribe

mbedtls

Choose email to subscribe with

general
  • source: mbedtls (main)
  • version: 3.6.4-2
  • maintainer: Debian IoT Maintainers (archive) (DMD)
  • uploaders: Andrea Pappacoda [DMD]
  • arch: all any
  • std-ver: 4.7.2
  • VCS: Git (Browse, QA)
versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]
[pool directory]
  • oldstable: 2.16.9-0.1
  • old-sec: 2.16.9-0.1+deb11u1
  • stable: 2.28.3-1
  • testing: 3.6.3-1
  • unstable: 3.6.4-2
versioned links
  • 2.16.9-0.1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 2.16.9-0.1+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 2.28.3-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 3.6.3-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 3.6.4-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
binaries
  • libmbedcrypto16
  • libmbedtls-dev (1 bugs: 0, 1, 0, 0)
  • libmbedtls-doc
  • libmbedtls21
  • libmbedx509-7
action needed
11 security issues in bullseye high

There are 11 open security issues in bullseye.

6 important issues:
  • CVE-2025-27809: Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client application calls mbedtls_ssl_set_hostname.
  • CVE-2025-27810: Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory to compose the TLS Finished message, potentially leading to authentication bypasses such as replays.
  • CVE-2025-47917: Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation. The function mbedtls_x509_string_to_names() takes a head argument that is documented as an output argument. The documentation does not suggest that the function will free that pointer; however, the function does call mbedtls_asn1_free_named_data_list() on that argument, which performs a deep free(). As a result, application code that uses this function (relying only on documented behavior) is likely to still hold pointers to the memory blocks that were freed, resulting in a high risk of use-after-free or double-free. In particular, the two sample programs x509/cert_write and x509/cert_req are affected (use-after-free if the san string contains more than one DN).
  • CVE-2025-48965: Mbed TLS before 3.6.4 has a NULL pointer dereference because mbedtls_asn1_store_named_data can trigger conflicting data with val.p of NULL but val.len greater than zero.
  • CVE-2025-52496: Mbed TLS before 3.6.4 has a race condition in AESNI detection if certain compiler optimizations occur. An attacker may be able to extract an AES key from a multithreaded program, or perform a GCM forgery.
  • CVE-2025-52497: Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer underflow, in mbedtls_pem_read_buffer and two mbedtls_pk_parse functions, via untrusted PEM input.
4 issues postponed or untriaged:
  • CVE-2024-23170: (needs triaging) An issue was discovered in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2. There was a timing side channel in RSA private operations. This side channel could be sufficient for a local attacker to recover the plaintext. It requires the attacker to send a large number of messages for decryption, as described in "Everlasting ROBOT: the Marvin Attack" by Hubert Kario.
  • CVE-2024-23775: (needs triaging) Integer Overflow vulnerability in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2, allows attackers to cause a denial of service (DoS) via mbedtls_x509_set_extension().
  • CVE-2024-28755: (needs triaging) An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When an SSL context was reset with the mbedtls_ssl_session_reset() API, the maximum TLS version to be negotiated was not restored to the configured one. An attacker was able to prevent an Mbed TLS server from establishing any TLS 1.3 connection, potentially resulting in a Denial of Service or forced version downgrade from TLS 1.3 to TLS 1.2.
  • CVE-2024-28960: (needs triaging) An issue was discovered in Mbed TLS 2.18.0 through 2.28.x before 2.28.8 and 3.x before 3.6.0, and Mbed Crypto. The PSA Crypto API mishandles shared memory.
1 ignored issue:
  • CVE-2022-35409: An issue was discovered in Mbed TLS before 2.28.1 and 3.x before 3.2.0. In some configurations, an unauthenticated attacker can send an invalid ClientHello message to a DTLS server that causes a heap-based buffer over-read of up to 255 bytes. This can cause a server crash or possibly information disclosure based on error responses. Affected configurations have MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE enabled and MBEDTLS_SSL_IN_CONTENT_LEN less than a threshold that depends on the configuration: 258 bytes if using mbedtls_ssl_cookie_check, and possibly up to 571 bytes with a custom cookie check function.
Created: 2025-03-25 Last update: 2025-07-22 23:32
10 security issues in bookworm high

There are 10 open security issues in bookworm.

4 important issues:
  • CVE-2025-47917: Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation. The function mbedtls_x509_string_to_names() takes a head argument that is documented as an output argument. The documentation does not suggest that the function will free that pointer; however, the function does call mbedtls_asn1_free_named_data_list() on that argument, which performs a deep free(). As a result, application code that uses this function (relying only on documented behavior) is likely to still hold pointers to the memory blocks that were freed, resulting in a high risk of use-after-free or double-free. In particular, the two sample programs x509/cert_write and x509/cert_req are affected (use-after-free if the san string contains more than one DN).
  • CVE-2025-48965: Mbed TLS before 3.6.4 has a NULL pointer dereference because mbedtls_asn1_store_named_data can trigger conflicting data with val.p of NULL but val.len greater than zero.
  • CVE-2025-52496: Mbed TLS before 3.6.4 has a race condition in AESNI detection if certain compiler optimizations occur. An attacker may be able to extract an AES key from a multithreaded program, or perform a GCM forgery.
  • CVE-2025-52497: Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer underflow, in mbedtls_pem_read_buffer and two mbedtls_pk_parse functions, via untrusted PEM input.
6 issues left for the package maintainer to handle:
  • CVE-2024-23170: (needs triaging) An issue was discovered in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2. There was a timing side channel in RSA private operations. This side channel could be sufficient for a local attacker to recover the plaintext. It requires the attacker to send a large number of messages for decryption, as described in "Everlasting ROBOT: the Marvin Attack" by Hubert Kario.
  • CVE-2024-23775: (needs triaging) Integer Overflow vulnerability in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2, allows attackers to cause a denial of service (DoS) via mbedtls_x509_set_extension().
  • CVE-2024-28755: (needs triaging) An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When an SSL context was reset with the mbedtls_ssl_session_reset() API, the maximum TLS version to be negotiated was not restored to the configured one. An attacker was able to prevent an Mbed TLS server from establishing any TLS 1.3 connection, potentially resulting in a Denial of Service or forced version downgrade from TLS 1.3 to TLS 1.2.
  • CVE-2024-28960: (needs triaging) An issue was discovered in Mbed TLS 2.18.0 through 2.28.x before 2.28.8 and 3.x before 3.6.0, and Mbed Crypto. The PSA Crypto API mishandles shared memory.
  • CVE-2025-27809: (needs triaging) Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client application calls mbedtls_ssl_set_hostname.
  • CVE-2025-27810: (needs triaging) Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory to compose the TLS Finished message, potentially leading to authentication bypasses such as replays.

You can find information about how to handle these issues in the security team's documentation.

Created: 2024-01-22 Last update: 2025-07-22 23:32
lintian reports 2 errors high
Lintian reports 2 errors about this package. You should make the package lintian clean getting rid of them.
Created: 2025-07-15 Last update: 2025-07-15 09:01
Build log checks report 1 warning low
Build log checks report 1 warning
Created: 2018-12-08 Last update: 2018-12-08 07:43
news
[rss feed]
  • [2025-07-23] mbedtls 3.6.4-2 MIGRATED to testing (Debian testing watch)
  • [2025-07-14] Accepted mbedtls 3.6.4-2 (source) into unstable (Andrea Pappacoda)
  • [2025-07-13] Accepted mbedtls 3.6.4-1 (source) into unstable (Andrea Pappacoda)
  • [2025-06-30] Accepted mbedtls 2.16.9-0.1+deb11u1 (source) into oldstable-security (Andrej Shadura) (signed by: Andrew Shadura)
  • [2025-04-08] mbedtls 3.6.3-1 MIGRATED to testing (Debian testing watch)
  • [2025-04-05] Accepted mbedtls 3.6.3-1 (source) into unstable (Andrea Pappacoda)
  • [2024-11-23] mbedtls 3.6.2-3 MIGRATED to testing (Debian testing watch)
  • [2024-11-17] Accepted mbedtls 3.6.2-3 (source) into unstable (Andrea Pappacoda)
  • [2024-11-06] Accepted mbedtls 3.6.2-2 (source) into unstable (Andrea Pappacoda)
  • [2024-10-23] Accepted mbedtls 3.6.2-1 (source) into unstable (Andrea Pappacoda)
  • [2024-10-17] Accepted mbedtls 3.6.0-3 (source) into unstable (Andrea Pappacoda)
  • [2024-04-25] mbedtls 2.28.8-1 MIGRATED to testing (Debian testing watch)
  • [2024-04-10] Accepted mbedtls 3.6.0-2 (source) into experimental (Andrea Pappacoda)
  • [2024-04-08] Accepted mbedtls 3.6.0-1 (source amd64 all) into experimental (Debian FTP Masters) (signed by: bage@debian.org)
  • [2024-03-31] Accepted mbedtls 2.28.8-1 (source) into unstable (Andrea Pappacoda)
  • [2024-02-29] Accepted mbedtls 2.28.7-1.1 (source) into unstable (Graham Inggs)
  • [2024-02-03] Accepted mbedtls 2.28.7-1.1~exp1 (source) into experimental (Graham Inggs)
  • [2024-01-31] mbedtls 2.28.7-1 MIGRATED to testing (Debian testing watch)
  • [2024-01-31] mbedtls 2.28.7-1 MIGRATED to testing (Debian testing watch)
  • [2024-01-27] Accepted mbedtls 2.28.7-1 (source) into unstable (Andrea Pappacoda)
  • [2023-12-27] mbedtls 2.28.6-1 MIGRATED to testing (Debian testing watch)
  • [2023-12-24] Accepted mbedtls 2.28.6-1 (source) into unstable (Andrea Pappacoda)
  • [2023-10-14] mbedtls 2.28.5-1 MIGRATED to testing (Debian testing watch)
  • [2023-10-14] mbedtls 2.28.5-1 MIGRATED to testing (Debian testing watch)
  • [2023-10-11] Accepted mbedtls 2.28.5-1 (source) into unstable (Philippe Coval)
  • [2023-09-14] mbedtls 2.28.4-1 MIGRATED to testing (Debian testing watch)
  • [2023-09-12] Accepted mbedtls 2.28.4-1 (source) into unstable (Andrea Pappacoda)
  • [2023-04-14] mbedtls 2.28.3-1 MIGRATED to testing (Debian testing watch)
  • [2023-03-29] Accepted mbedtls 2.28.3-1 (source) into unstable (Andrea Pappacoda)
  • [2022-12-28] mbedtls 2.28.2-1 MIGRATED to testing (Debian testing watch)
  • 1
  • 2
bugs [bug history graph]
  • all: 4
  • RC: 0
  • I&N: 3
  • M&W: 1
  • F&P: 0
  • patch: 0
links
  • homepage
  • lintian (2, 0)
  • buildd: logs, checks, reproducibility, cross
  • popcon
  • browse source code
  • edit tags
  • other distros
  • security tracker
  • debian patches
  • debci
ubuntu Ubuntu logo [Information about Ubuntu for Debian Developers]
  • version: 3.6.2-3ubuntu1
  • patches for 3.6.2-3ubuntu1

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers
Report problems to the tracker.debian.org pseudo-package in the Debian BTS.
Documentation — Bugs — Git Repository — Contributing