Security update for mbedtls SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2022:10247-1 Final 1 1 2022-12-22T12:33:10Z current 2022-12-22T12:33:10Z 2022-12-22T12:33:10Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for mbedtls This update for mbedtls fixes the following issues: - CVE-2022-35409: Fixed buffer overread in DTLS ClientHello parsing (boo#1201581). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2022-10247 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3NAO4EU3XHQJB2IY7LNSERGELWFEJAUJ/ E-Mail link for openSUSE-SU-2022:10247-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1201581 SUSE Bug 1201581 https://www.suse.com/security/cve/CVE-2021-35409/ SUSE CVE CVE-2021-35409 page https://www.suse.com/security/cve/CVE-2022-35409/ SUSE CVE CVE-2022-35409 page SUSE Package Hub 15 SP3 openSUSE Leap 15.3 libmbedcrypto3-2.16.9-bp153.2.8.1 libmbedcrypto3-32bit-2.16.9-bp153.2.8.1 libmbedcrypto3-64bit-2.16.9-bp153.2.8.1 libmbedtls12-2.16.9-bp153.2.8.1 libmbedtls12-32bit-2.16.9-bp153.2.8.1 libmbedtls12-64bit-2.16.9-bp153.2.8.1 libmbedx509-0-2.16.9-bp153.2.8.1 libmbedx509-0-32bit-2.16.9-bp153.2.8.1 libmbedx509-0-64bit-2.16.9-bp153.2.8.1 mbedtls-devel-2.16.9-bp153.2.8.1 libmbedcrypto3-2.16.9-bp153.2.8.1 as a component of SUSE Package Hub 15 SP3 libmbedcrypto3-32bit-2.16.9-bp153.2.8.1 as a component of SUSE Package Hub 15 SP3 libmbedcrypto3-64bit-2.16.9-bp153.2.8.1 as a component of SUSE Package Hub 15 SP3 libmbedtls12-2.16.9-bp153.2.8.1 as a component of SUSE Package Hub 15 SP3 libmbedtls12-32bit-2.16.9-bp153.2.8.1 as a component of SUSE Package Hub 15 SP3 libmbedtls12-64bit-2.16.9-bp153.2.8.1 as a component of SUSE Package Hub 15 SP3 libmbedx509-0-2.16.9-bp153.2.8.1 as a component of SUSE Package Hub 15 SP3 libmbedx509-0-32bit-2.16.9-bp153.2.8.1 as a component of SUSE Package Hub 15 SP3 libmbedx509-0-64bit-2.16.9-bp153.2.8.1 as a component of SUSE Package Hub 15 SP3 mbedtls-devel-2.16.9-bp153.2.8.1 as a component of SUSE Package Hub 15 SP3 libmbedcrypto3-2.16.9-bp153.2.8.1 as a component of openSUSE Leap 15.3 libmbedcrypto3-32bit-2.16.9-bp153.2.8.1 as a component of openSUSE Leap 15.3 libmbedcrypto3-64bit-2.16.9-bp153.2.8.1 as a component of openSUSE Leap 15.3 libmbedtls12-2.16.9-bp153.2.8.1 as a component of openSUSE Leap 15.3 libmbedtls12-32bit-2.16.9-bp153.2.8.1 as a component of openSUSE Leap 15.3 libmbedtls12-64bit-2.16.9-bp153.2.8.1 as a component of openSUSE Leap 15.3 libmbedx509-0-2.16.9-bp153.2.8.1 as a component of openSUSE Leap 15.3 libmbedx509-0-32bit-2.16.9-bp153.2.8.1 as a component of openSUSE Leap 15.3 libmbedx509-0-64bit-2.16.9-bp153.2.8.1 as a component of openSUSE Leap 15.3 mbedtls-devel-2.16.9-bp153.2.8.1 as a component of openSUSE Leap 15.3 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVE-2021-35409 SUSE Package Hub 15 SP3:libmbedcrypto3-2.16.9-bp153.2.8.1 SUSE Package Hub 15 SP3:libmbedcrypto3-32bit-2.16.9-bp153.2.8.1 SUSE Package Hub 15 SP3:libmbedcrypto3-64bit-2.16.9-bp153.2.8.1 SUSE Package Hub 15 SP3:libmbedtls12-2.16.9-bp153.2.8.1 SUSE Package Hub 15 SP3:libmbedtls12-32bit-2.16.9-bp153.2.8.1 SUSE Package Hub 15 SP3:libmbedtls12-64bit-2.16.9-bp153.2.8.1 SUSE Package Hub 15 SP3:libmbedx509-0-2.16.9-bp153.2.8.1 SUSE Package Hub 15 SP3:libmbedx509-0-32bit-2.16.9-bp153.2.8.1 SUSE Package Hub 15 SP3:libmbedx509-0-64bit-2.16.9-bp153.2.8.1 SUSE Package Hub 15 SP3:mbedtls-devel-2.16.9-bp153.2.8.1 openSUSE Leap 15.3:libmbedcrypto3-2.16.9-bp153.2.8.1 openSUSE Leap 15.3:libmbedcrypto3-32bit-2.16.9-bp153.2.8.1 openSUSE Leap 15.3:libmbedcrypto3-64bit-2.16.9-bp153.2.8.1 openSUSE Leap 15.3:libmbedtls12-2.16.9-bp153.2.8.1 openSUSE Leap 15.3:libmbedtls12-32bit-2.16.9-bp153.2.8.1 openSUSE Leap 15.3:libmbedtls12-64bit-2.16.9-bp153.2.8.1 openSUSE Leap 15.3:libmbedx509-0-2.16.9-bp153.2.8.1 openSUSE Leap 15.3:libmbedx509-0-32bit-2.16.9-bp153.2.8.1 openSUSE Leap 15.3:libmbedx509-0-64bit-2.16.9-bp153.2.8.1 openSUSE Leap 15.3:mbedtls-devel-2.16.9-bp153.2.8.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3NAO4EU3XHQJB2IY7LNSERGELWFEJAUJ/ https://www.suse.com/security/cve/CVE-2021-35409.html CVE-2021-35409 An issue was discovered in Mbed TLS before 2.28.1 and 3.x before 3.2.0. In some configurations, an unauthenticated attacker can send an invalid ClientHello message to a DTLS server that causes a heap-based buffer over-read of up to 255 bytes. This can cause a server crash or possibly information disclosure based on error responses. Affected configurations have MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE enabled and MBEDTLS_SSL_IN_CONTENT_LEN less than a threshold that depends on the configuration: 258 bytes if using mbedtls_ssl_cookie_check, and possibly up to 571 bytes with a custom cookie check function. CVE-2022-35409 SUSE Package Hub 15 SP3:libmbedcrypto3-2.16.9-bp153.2.8.1 SUSE Package Hub 15 SP3:libmbedcrypto3-32bit-2.16.9-bp153.2.8.1 SUSE Package Hub 15 SP3:libmbedcrypto3-64bit-2.16.9-bp153.2.8.1 SUSE Package Hub 15 SP3:libmbedtls12-2.16.9-bp153.2.8.1 SUSE Package Hub 15 SP3:libmbedtls12-32bit-2.16.9-bp153.2.8.1 SUSE Package Hub 15 SP3:libmbedtls12-64bit-2.16.9-bp153.2.8.1 SUSE Package Hub 15 SP3:libmbedx509-0-2.16.9-bp153.2.8.1 SUSE Package Hub 15 SP3:libmbedx509-0-32bit-2.16.9-bp153.2.8.1 SUSE Package Hub 15 SP3:libmbedx509-0-64bit-2.16.9-bp153.2.8.1 SUSE Package Hub 15 SP3:mbedtls-devel-2.16.9-bp153.2.8.1 openSUSE Leap 15.3:libmbedcrypto3-2.16.9-bp153.2.8.1 openSUSE Leap 15.3:libmbedcrypto3-32bit-2.16.9-bp153.2.8.1 openSUSE Leap 15.3:libmbedcrypto3-64bit-2.16.9-bp153.2.8.1 openSUSE Leap 15.3:libmbedtls12-2.16.9-bp153.2.8.1 openSUSE Leap 15.3:libmbedtls12-32bit-2.16.9-bp153.2.8.1 openSUSE Leap 15.3:libmbedtls12-64bit-2.16.9-bp153.2.8.1 openSUSE Leap 15.3:libmbedx509-0-2.16.9-bp153.2.8.1 openSUSE Leap 15.3:libmbedx509-0-32bit-2.16.9-bp153.2.8.1 openSUSE Leap 15.3:libmbedx509-0-64bit-2.16.9-bp153.2.8.1 openSUSE Leap 15.3:mbedtls-devel-2.16.9-bp153.2.8.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3NAO4EU3XHQJB2IY7LNSERGELWFEJAUJ/ https://www.suse.com/security/cve/CVE-2022-35409.html CVE-2022-35409 https://bugzilla.suse.com/1201581 SUSE Bug 1201581