From 91bfce113e895fc9637707e73567e5d13da3f169 Mon Sep 17 00:00:00 2001 From: Peter Korsgaard Date: Wed, 26 Mar 2025 21:16:51 +0100 Subject: [PATCH] package/mbedtls: security bump to version 2.8.10 Fixes the following security issues: - CVE-2025-27809: Note that TLS clients should generally call mbedtls_ssl_set_hostname() if they use certificate authentication (i.e. not pre-shared keys). Otherwise, in many scenarios, the server could be impersonated. The library will now prevent the handshake and return MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME if mbedtls_ssl_set_hostname() has not been called. https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-03-1/ - CVE-2025-27810: Zeroize temporary heap buffers used in PSA operations. Fix a vulnerability in the TLS 1.2 handshake. If memory allocation failed or there was a cryptographic hardware failure when calculating the Finished message, it could be calculated incorrectly. This would break the security guarantees of the TLS handshake. https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-03-2/ For more details, see the release notes: https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-2.28.10 Signed-off-by: Peter Korsgaard Signed-off-by: Julien Olivain --- package/mbedtls/mbedtls.hash | 4 ++-- package/mbedtls/mbedtls.mk | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/package/mbedtls/mbedtls.hash b/package/mbedtls/mbedtls.hash index 9de7f731da..6fc68ddac6 100644 --- a/package/mbedtls/mbedtls.hash +++ b/package/mbedtls/mbedtls.hash @@ -1,4 +1,4 @@ -# From https://github.com/ARMmbed/mbedtls/releases/tag/v2.28.9: -sha256 e85ea97aaf78dd6c0a5ba2e54dd5932ffa15f39abfc189c26beef7684630c02b mbedtls-2.28.9.tar.bz2 +# From https://github.com/ARMmbed/mbedtls/releases/tag/v2.28.10: +sha256 19e5b81fdac0fe22009b9e2bdcd52d7dcafbf62bc67fc59cf0a76b5b5540d149 mbedtls-2.28.10.tar.bz2 # Locally calculated sha256 9b405ef4c89342f5eae1dd828882f931747f71001cfba7d114801039b52ad09b LICENSE diff --git a/package/mbedtls/mbedtls.mk b/package/mbedtls/mbedtls.mk index 2faa6dff55..fd6682fbfd 100644 --- a/package/mbedtls/mbedtls.mk +++ b/package/mbedtls/mbedtls.mk @@ -4,7 +4,7 @@ # ################################################################################ -MBEDTLS_VERSION = 2.28.9 +MBEDTLS_VERSION = 2.28.10 MBEDTLS_SITE = https://github.com/Mbed-TLS/mbedtls/releases/download/mbedtls-$(MBEDTLS_VERSION) MBEDTLS_SOURCE = mbedtls-$(MBEDTLS_VERSION).tar.bz2 MBEDTLS_CONF_OPTS = \