openSUSE-SU-2026:21864-1

See a problem?

Import Source

https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21864-1.json

JSON Data

https://api.osv.dev/v1/vulns/openSUSE-SU-2026:21864-1

Upstream

CVE (2)

Related

CVE (2)

Published

2026-09-16T15:11:09Z

Modified

2026-09-17T18:23:15Z

Summary

Security update for mbedtls-2

Details

This update for mbedtls-2 fixes the following issues:

Changes in mbedtls-2:

CVE-2025-52496: race condition in AESNI support detection, AES key disclosure / GCM forgery in multithreaded programs (boo#1245810)
CVE-2025-59438: padding oracle through timing of cipher error reporting (boo#1252454)

References

Affected packages

openSUSE:Leap 16.0 / mbedtls-2

Package

Name: mbedtls-2
Purl: pkg:rpm/opensuse/mbedtls-2&distro=openSUSE%20Leap%2016.0

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.28.10-bp160.2.1

Ecosystem specific

{
    "binaries":  [
        {
            "libmbedcrypto7":  "2.28.10-bp160.2.1",
            "libmbedcrypto7-x86-64-v3":  "2.28.10-bp160.2.1",
            "libmbedtls14":  "2.28.10-bp160.2.1",
            "libmbedtls14-x86-64-v3":  "2.28.10-bp160.2.1",
            "libmbedx509-1":  "2.28.10-bp160.2.1",
            "libmbedx509-1-x86-64-v3":  "2.28.10-bp160.2.1",
            "mbedtls-2-devel":  "2.28.10-bp160.2.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21864-1.json"