Описание
Security update for mbedtls
This update for mbedtls fixes the following issues:
Changes in mbedtls:
- Update to 3.6.6 (LTS maintenance update from 3.6.1); security fixes
accumulated across the 3.6.2-3.6.6 releases:
- CVE-2024-49195 (boo#1231708): buffer underrun in pkwrite when writing an opaque key pair
- CVE-2025-27809 (boo#1240051): certificate verification accepted arbitrary hostnames
- CVE-2025-27810 (boo#1240052): possible authentication bypass on failed memory allocation / hardware errors
- CVE-2025-47917 (boo#1246783): misleading memory management in mbedtls_x509_string_to_names()
- CVE-2025-48965 (boo#1246784): NULL pointer dereference after mbedtls_asn1_store_named_data()
- CVE-2025-49087 (boo#1246973): timing side channel in PKCS#7 padding removal
- CVE-2025-49600 (boo#1245808): unchecked return values in LMS verification allow signature bypass via fault injection
- CVE-2025-49601 (boo#1245809): out-of-bounds read in mbedtls_lms_import_public_key()
- CVE-2025-52496 (boo#1245810): race in AES-NI support detection can lead to AES key extraction or GCM forgery
- CVE-2025-52497 (boo#1245811): one-byte heap underflow when parsing PEM-encrypted material
- CVE-2025-54764 (boo#1252341): timing attacks in RSA operations
- CVE-2025-59438 (boo#1252454): padding-oracle attack via timing of cipher error reporting
- CVE-2026-25833: PSA RNG state duplicated across fork()
- CVE-2026-25834: TLS 1.3 HelloRetryRequest man-in-the-middle session-resumption downgrade
- CVE-2026-25835: RNG state duplicated when application/VM state is cloned
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1231708
- SUSE Bug 1240051
- SUSE Bug 1240052
- SUSE Bug 1245808
- SUSE Bug 1245809
- SUSE Bug 1245810
- SUSE Bug 1245811
- SUSE Bug 1246783
- SUSE Bug 1246784
- SUSE Bug 1246973
- SUSE Bug 1252341
- SUSE Bug 1252454
- SUSE CVE CVE-2024-49195 page
- SUSE CVE CVE-2025-27809 page
- SUSE CVE CVE-2025-27810 page
- SUSE CVE CVE-2025-47917 page
- SUSE CVE CVE-2025-48965 page
- SUSE CVE CVE-2025-49087 page
- SUSE CVE CVE-2025-49600 page
Описание
Mbed TLS 3.5.x through 3.6.x before 3.6.2 has a buffer underrun in pkwrite when writing an opaque key pair
Затронутые продукты
Ссылки
- CVE-2024-49195
- SUSE Bug 1231707
Описание
Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client application calls mbedtls_ssl_set_hostname.
Затронутые продукты
Ссылки
- CVE-2025-27809
- SUSE Bug 1240051
Описание
Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory to compose the TLS Finished message, potentially leading to authentication bypasses such as replays.
Затронутые продукты
Ссылки
- CVE-2025-27810
- SUSE Bug 1240052
Описание
Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation. The function mbedtls_x509_string_to_names() takes a head argument that is documented as an output argument. The documentation does not suggest that the function will free that pointer; however, the function does call mbedtls_asn1_free_named_data_list() on that argument, which performs a deep free(). As a result, application code that uses this function (relying only on documented behavior) is likely to still hold pointers to the memory blocks that were freed, resulting in a high risk of use-after-free or double-free. In particular, the two sample programs x509/cert_write and x509/cert_req are affected (use-after-free if the san string contains more than one DN).
Затронутые продукты
Ссылки
- CVE-2025-47917
- SUSE Bug 1246783
Описание
Mbed TLS before 3.6.4 has a NULL pointer dereference because mbedtls_asn1_store_named_data can trigger conflicting data with val.p of NULL but val.len greater than zero.
Затронутые продукты
Ссылки
- CVE-2025-48965
- SUSE Bug 1246784
Описание
In Mbed TLS 3.6.1 through 3.6.3 before 3.6.4, a timing discrepancy in block cipher padding removal allows an attacker to recover the plaintext when PKCS#7 padding mode is used.
Затронутые продукты
Ссылки
- CVE-2025-49087
- SUSE Bug 1246973
Описание
In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_verify may accept invalid signatures if hash computation fails and internal errors go unchecked, enabling LMS (Leighton-Micali Signature) forgery in a fault scenario. Specifically, unchecked return values in mbedtls_lms_verify allow an attacker (who can induce a hardware hash accelerator fault) to bypass LMS signature verification by reusing stale stack data, resulting in acceptance of an invalid signature. In mbedtls_lms_verify, the return values of the internal Merkle tree functions create_merkle_leaf_value and create_merkle_internal_value are not checked. These functions return an integer that indicates whether the call succeeded or not. If a failure occurs, the output buffer (Tc_candidate_root_node) may remain uninitialized, and the result of the signature verification is unpredictable. When the software implementation of SHA-256 is used, these functions will not fail. However, with hardware-accelerated hashing, an attacker could use fault injection against the accelerator to bypass verification.
Затронутые продукты
Ссылки
- CVE-2025-49600
- SUSE Bug 1245808
Описание
In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_import_public_key does not check that the input buffer is at least 4 bytes before reading a 32-bit field, allowing a possible out-of-bounds read on truncated input. Specifically, an out-of-bounds read in mbedtls_lms_import_public_key allows context-dependent attackers to trigger a crash or limited adjacent-memory disclosure by supplying a truncated LMS (Leighton-Micali Signature) public-key buffer under four bytes. An LMS public key starts with a 4-byte type indicator. The function mbedtls_lms_import_public_key reads this type indicator before validating the size of its input.
Затронутые продукты
Ссылки
- CVE-2025-49601
- SUSE Bug 1245809
Описание
Mbed TLS before 3.6.4 has a race condition in AESNI detection if certain compiler optimizations occur. An attacker may be able to extract an AES key from a multithreaded program, or perform a GCM forgery.
Затронутые продукты
Ссылки
- CVE-2025-52496
- SUSE Bug 1245810
Описание
Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer underflow, in mbedtls_pem_read_buffer and two mbedtls_pk_parse functions, via untrusted PEM input.
Затронутые продукты
Ссылки
- CVE-2025-52497
- SUSE Bug 1245811
Описание
Mbed TLS before 3.6.5 allows a local timing attack against certain RSA operations, and direct calls to mbedtls_mpi_mod_inv or mbedtls_mpi_gcd.
Затронутые продукты
Ссылки
- CVE-2025-54764
- SUSE Bug 1252341
Описание
Mbed TLS through 3.6.4 has an Observable Timing Discrepancy.
Затронутые продукты
Ссылки
- CVE-2025-59438
- SUSE Bug 1252433
Описание
Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer overflow in the x509_inet_pton_ipv6() function
Затронутые продукты
Ссылки
- CVE-2026-25833
- SUSE Bug 1261476
- SUSE Bug 1262730
Описание
Mbed TLS v3.3.0 up to 3.6.5 and 4.0.0 allows Algorithm Downgrade.
Затронутые продукты
Ссылки
- CVE-2026-25834
- SUSE Bug 1261477
- SUSE Bug 1262728
Описание
Mbed TLS before 3.6.6 and TF-PSA-Crypto before 1.1.0 misuse seeds in a Pseudo-Random Number Generator (PRNG).
Затронутые продукты
Ссылки
- CVE-2026-25835
- SUSE Bug 1261478
- SUSE Bug 1262727