mbedtls - Debian Package Tracker

general

source: mbedtls (main)
version: 2.28.4-1
maintainer: Debian IoT Maintainers (archive) (DMD)
uploaders: Andrea Pappacoda [DMD] [DM]
arch: all any
std-ver: 4.6.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2.16.0-1
o-o-sec: 2.16.9-0~deb10u1
oldstable: 2.16.9-0.1
stable: 2.28.3-1
testing: 2.28.4-1
unstable: 2.28.4-1

versioned links

2.16.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.16.9-0~deb10u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.16.9-0.1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.28.3-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.28.4-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libmbedcrypto7
libmbedtls-dev (1 bugs: 0, 0, 1, 0)
libmbedtls-doc
libmbedtls14
libmbedx509-1

action needed

A new upstream version is available: 2.28.5 high

A new upstream version 2.28.5 is available, you should consider packaging it.

Created: 2023-10-06 Last update: 2023-10-08 02:40

2 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 362cfbb393446f9df965f390ea216717d5b01798
Merge: 7095087ed 9072a8979
Author: Andrea Pappacoda <andrea@pappacoda.it>
Date:   Tue Sep 12 12:57:35 2023 +0000

    Merge branch 'rzr/review/master' into 'debian/master'
    
    debian/control: Update URL to use team's git
    
    See merge request debian-iot-team/mbedtls!1

commit 9072a89799fb603fcd1cbe56aca88496a4ceceb1
Author: Philippe Coval <rzr@users.sf.net>
Date:   Tue Aug 1 19:30:17 2023 +0200

    debian/control: Update URL to use team's git
    
    Relate-to: https://salsa.debian.org/debian/mbedtls/-/commit/561cef9dc17d8007425bb76b0fc056ae2ab0c5ac#note_415795
    Signed-off-by: Philippe Coval <rzr@users.sf.net>

https://salsa.debian.org/api/v4/projects/debian%2Fmbedtls API request failed: 404 Not Found at /srv/qa.debian.org/data/vcswatch/vcswatch line 405.

Created: 2023-07-27 Last update: 2023-10-08 02:44

4 low-priority security issues in bullseye low

There are 4 open security issues in bullseye.

4 issues left for the package maintainer to handle:

CVE-2021-36647: (needs triaging) Use of a Broken or Risky Cryptographic Algorithm in the function mbedtls_mpi_exp_mod() in lignum.c in Mbed TLS Mbed TLS all versions before 3.0.0, 2.27.0 or 2.16.11 allows attackers with access to precise enough timing and memory access information (typically an untrusted operating system attacking a secure enclave such as SGX or the TrustZone secure world) to recover the private keys used in RSA.
CVE-2021-43666: (needs triaging) A Denial of Service vulnerability exists in mbed TLS 3.0.0 and earlier in the mbedtls_pkcs12_derivation function when an input password's length is 0.
CVE-2022-35409: (needs triaging) An issue was discovered in Mbed TLS before 2.28.1 and 3.x before 3.2.0. In some configurations, an unauthenticated attacker can send an invalid ClientHello message to a DTLS server that causes a heap-based buffer over-read of up to 255 bytes. This can cause a server crash or possibly information disclosure based on error responses. Affected configurations have MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE enabled and MBEDTLS_SSL_IN_CONTENT_LEN less than a threshold that depends on the configuration: 258 bytes if using mbedtls_ssl_cookie_check, and possibly up to 571 bytes with a custom cookie check function.
CVE-2022-46392: (needs triaging) An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. An adversary with access to precise enough information about memory accesses (typically, an untrusted operating system attacking a secure enclave) can recover an RSA private key after observing the victim performing a single private-key operation, if the window size (MBEDTLS_MPI_WINDOW_SIZE) used for the exponentiation is 3 or smaller.

You can find information about how to handle these issues in the security team's documentation.

2 issues that should be fixed with the next stable update:

CVE-2021-24119: In Trusted Firmware Mbed TLS 2.24.0, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments that can be single stepped, especially Intel SGX.
CVE-2021-44732: Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_session() failure.

Created: 2022-07-04 Last update: 2023-09-14 06:31

Build log checks report 1 warning low

Build log checks report 1 warning

Created: 2018-12-08 Last update: 2018-12-08 07:43

news

[rss feed]

[2023-09-14] mbedtls 2.28.4-1 MIGRATED to testing (Debian testing watch)
[2023-09-12] Accepted mbedtls 2.28.4-1 (source) into unstable (Andrea Pappacoda)
[2023-04-14] mbedtls 2.28.3-1 MIGRATED to testing (Debian testing watch)
[2023-03-29] Accepted mbedtls 2.28.3-1 (source) into unstable (Andrea Pappacoda)
[2022-12-28] mbedtls 2.28.2-1 MIGRATED to testing (Debian testing watch)
[2022-12-25] Accepted mbedtls 2.16.9-0~deb10u1 (source) into oldstable (Markus Koschany)
[2022-12-15] Accepted mbedtls 2.28.2-1 (source) into unstable (Andrea Pappacoda)
[2022-07-15] mbedtls 2.28.1-1 MIGRATED to testing (Debian testing watch)
[2022-07-13] Accepted mbedtls 2.28.1-1 (source) into unstable (Andrea Pappacoda) (signed by: bage@debian.org)
[2022-04-08] mbedtls 2.28.0-2 MIGRATED to testing (Debian testing watch)
[2022-04-06] Accepted mbedtls 2.28.0-2 (source) into unstable (Andrea Pappacoda) (signed by: bage@debian.org)
[2022-02-19] mbedtls 2.28.0-1 MIGRATED to testing (Debian testing watch)
[2022-02-16] Accepted mbedtls 2.28.0-1 (source) into unstable (Andrea Pappacoda) (signed by: Wookey)
[2022-02-16] Accepted mbedtls 2.28.0-0.3 (source) into unstable (Andrea Pappacoda) (signed by: Wookey)
[2022-01-18] Accepted mbedtls 2.28.0-0.2 (source) into experimental (Andrea Pappacoda) (signed by: Wookey)
[2022-01-14] Accepted mbedtls 2.28.0-0.1 (source amd64 all) into experimental, experimental (Debian FTP Masters) (signed by: Wookey)
[2021-11-29] mbedtls 2.16.11-0.3 MIGRATED to testing (Debian testing watch)
[2021-11-26] Accepted mbedtls 2.16.11-0.3 (source) into unstable (Andrea Pappacoda) (signed by: bage@debian.org)
[2021-11-25] Accepted mbedtls 2.16.11-0.2 (source) into unstable (Gianfranco Costamagna)
[2021-11-23] Accepted mbedtls 2.4.2-1+deb9u4 (source) into oldoldstable (Emilio Pozuelo Monfort)
[2021-11-18] Accepted mbedtls 2.16.11-0.1 (source) into unstable (Andrea Pappacoda) (signed by: bage@debian.org)
[2020-12-29] mbedtls 2.16.9-0.1 MIGRATED to testing (Debian testing watch)
[2020-12-27] Accepted mbedtls 2.16.9-0.1 (source) into unstable (Wookey)
[2020-03-03] mbedtls 2.16.5-1 MIGRATED to testing (Debian testing watch)
[2020-02-29] Accepted mbedtls 2.16.5-1 (source) into unstable (James Cowgill)
[2020-01-31] mbedtls 2.16.4-1 MIGRATED to testing (Debian testing watch)
[2020-01-28] Accepted mbedtls 2.16.4-1 (source) into unstable (James Cowgill)
[2019-10-01] mbedtls 2.16.3-1 MIGRATED to testing (Debian testing watch)
[2019-09-28] Accepted mbedtls 2.16.3-1 (source) into unstable (James Cowgill)
[2019-07-18] mbedtls 2.16.2-1 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 5
RC: 0
I&N: 0
M&W: 5
F&P: 0
patch: 0

links

homepage
lintian
buildd: logs, checks, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.28.3-1