openSUSE-SU-2017:0792-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2017:0792-1.json
JSON Data
https://api.osv.dev/v1/vulns/openSUSE-SU-2017:0792-1
Related
Published
2017-03-22T10:02:23Z
Modified
2017-03-22T10:02:23Z
Summary
Security update for mbedtls
Details

This update to mbedtls 1.3.19 fixes security issues and bugs.

The following vulnerability was fixed:

CVE-2017-2784: A remote user could have used a specially crafted certificate to cause mbedtls to free a buffer allocated on the stack when verifying the validity of public key with a secp224k1 curve, which could have allowed remote code execution on some platforms (boo#1029017)

The following non-security changes are included:

  • Add checks to prevent signature forgeries for very large messages while using RSA through the PK module in 64-bit systems.
  • Fixed potential livelock during the parsing of a CRL in PEM format
References

Affected packages

SUSE:Package Hub 12 / mbedtls

Package

Name
mbedtls
Purl
pkg:rpm/suse/mbedtls&distro=SUSE%20Package%20Hub%2012

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.3.19-5.1

Ecosystem specific 

{
    "binaries": [
        {
            "libmbedtls9": "1.3.19-5.1",
            "mbedtls-devel": "1.3.19-5.1"
        }
    ]
}