From 5e057ff46e1e53e10cc533a8ade7bf4868af580e Mon Sep 17 00:00:00 2001 From: Fabrice Fontaine Date: Fri, 26 Jan 2024 23:23:24 +0100 Subject: [PATCH] package/mbedtls: security bump to version 2.28.7 - Fix CVE-2024-23170 and CVE-2024-23775 - Mbed TLS is now released under a dual Apache-2.0 OR GPL-2.0-or-later license. Users may choose which license they take the code under: https://github.com/Mbed-TLS/mbedtls/commit/f429557c5900d3b90bd10a21b228f719e80f81a2 https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-01-1/ https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-01-2/ https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.6 https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.7 Signed-off-by: Fabrice Fontaine Signed-off-by: Yann E. MORIN (cherry picked from commit 52fd4753fe64208bfc25dc8a298f067da5c4c4b4) Signed-off-by: Peter Korsgaard --- package/mbedtls/mbedtls.hash | 6 +++--- package/mbedtls/mbedtls.mk | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package/mbedtls/mbedtls.hash b/package/mbedtls/mbedtls.hash index d0cd0b2105..3ec151a859 100644 --- a/package/mbedtls/mbedtls.hash +++ b/package/mbedtls/mbedtls.hash @@ -1,4 +1,4 @@ -# From https://github.com/ARMmbed/mbedtls/releases/tag/v2.28.4: -sha256 849e86b626e42ded6bf67197b64aa771daa54e2a7e2868dc67e1e4711959e5e3 mbedtls-2.28.5.tar.gz +# From https://github.com/ARMmbed/mbedtls/releases/tag/v2.28.7: +sha256 1df6073f0cf6a4e1953890bf5e0de2a8c7e6be50d6d6c69fa9fefcb1d14e981a mbedtls-2.28.7.tar.gz # Locally calculated -sha256 cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30 LICENSE +sha256 9b405ef4c89342f5eae1dd828882f931747f71001cfba7d114801039b52ad09b LICENSE diff --git a/package/mbedtls/mbedtls.mk b/package/mbedtls/mbedtls.mk index 1b941e04f4..cdb4aef4f4 100644 --- a/package/mbedtls/mbedtls.mk +++ b/package/mbedtls/mbedtls.mk @@ -4,7 +4,7 @@ # ################################################################################ -MBEDTLS_VERSION = 2.28.5 +MBEDTLS_VERSION = 2.28.7 MBEDTLS_SITE = $(call github,ARMmbed,mbedtls,v$(MBEDTLS_VERSION)) MBEDTLS_CONF_OPTS = \ -DCMAKE_C_FLAGS="$(TARGET_CFLAGS) -std=c99" \ @@ -12,7 +12,7 @@ MBEDTLS_CONF_OPTS = \ -DENABLE_TESTING=OFF \ -DMBEDTLS_FATAL_WARNINGS=OFF MBEDTLS_INSTALL_STAGING = YES -MBEDTLS_LICENSE = Apache-2.0 +MBEDTLS_LICENSE = Apache-2.0 or GPL-2.0+ MBEDTLS_LICENSE_FILES = LICENSE MBEDTLS_CPE_ID_VENDOR = arm MBEDTLS_CPE_ID_PRODUCT = mbed_tls