This website requires JavaScript.
Explore
Help
Sign In
pool
/
mbedtls
SHA256
Watch
2
Star
0
Fork
1
You've already forked mbedtls
Code
Issues
Pull Requests
Actions
Packages
Projects
Releases
Wiki
Activity
874cecdf09
mbedtls
/
baselibs.conf
4 lines
42 B
Plaintext
Raw
Normal View
History
Unescape
Escape
Accepting request 827276 from home:dirkmueller:branches:security:tls - update to 2.23.0: a lot of changes see https://github.com/ARMmbed/mbedtls/releases/tag/v2.23.0 * Fix a side channel vulnerability in modular exponentiation that could reveal an RSA private key used in a secure enclave. Noticed by Sangho Lee, Ming-Wei Shih, Prasun Gera, Taesoo Kim and Hyesoon Kim (Georgia Institute of Technology); and Marcus Peinado (Microsoft Research). Reported by Raoul Strackx (Fortanix) in #3394. * Fix side channel in mbedtls_ecp_check_pub_priv() and mbedtls_pk_parse_key() / mbedtls_pk_parse_keyfile() (when loading a private key that didn't include the uncompressed public key), as well as mbedtls_ecp_mul() / mbedtls_ecp_mul_restartable() when called with a NULL f_rng argument. An attacker with access to precise enough timing and memory access information (typically an untrusted operating system attacking a secure enclave) could fully recover the ECC private key. Found and reported by Alejandro Cabrera Aldaya and Billy Brumley. * Fix issue in Lucky 13 counter-measure that could make it ineffective when hardware accelerators were used (using one of the MBEDTLS_SHAxxx_ALT macros). This would cause the original Lucky 13 attack to be possible in those configurations, allowing an active network attacker to recover plaintext after repeated timing measurements under some conditions. Reported and fix suggested by Luc Perneel in #3246. OBS-URL: https://build.opensuse.org/request/show/827276 OBS-URL: https://build.opensuse.org/package/show/security:tls/mbedtls?expand=0&rev=15
2020-08-17 12:36:14 +02:00
libmbedtls13
libmbedx509-1
libmbedcrypto5
Reference in New Issue
Copy Permalink