MGASA-2024-0037
- Source
- https://advisories.mageia.org/MGASA-2024-0037.html
- Import Source
- https://advisories.mageia.org/MGASA-2024-0037.json
- JSON Data
- https://api.osv.dev/v1/vulns/MGASA-2024-0037
- Published
- 2024-02-14T23:02:34Z
- Modified
- 2026-04-16T04:23:12Z
- Summary
- Updated mbedtls packages fix security vulnerabilities
- Details
-
This update brings the mbedtls packages from 2.28.3 to the latest 2.28.7 release in the LTS branch, fixing a number of bugs as well the following security vulnerabilities:
- Buffer overread in TLS stream cipher suites.
- Timing side channel in private key RSA operations.
- Buffer overflow in mbedtls_x509_set_extension. See the linked release notes for details.
- References
-
- https://advisories.mageia.org/MGASA-2024-0037.html
- https://bugs.mageia.org/show_bug.cgi?id=32844
- https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.4
- https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.5
- https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-2.28.5
- https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.6
- https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.7
- https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2023-10-1/
- https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-01-1/
- https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-01-2/
- Credits
-
-
- Mageia - COORDINATOR
-
Affected packages
Mageia:9 / mbedtls
Package
- Name
- mbedtls
- Purl
- pkg:rpm/mageia/mbedtls?arch=source&distro=mageia-9