8:19 a.m.
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2018-9d1b6b3b26
2018-06-01 13:19:06.452850
--------------------------------------------------------------------------------
Name : mbedtls
Product : Fedora EPEL 7
Version : 2.7.3
Release : 1.el7
URL : https://tls.mbed.org/
Summary : Light-weight cryptographic and SSL/TLS library
Description :
Mbed TLS is a light-weight open source cryptographic and SSL/TLS
library written in C. Mbed TLS makes it easy for developers to include
cryptographic and SSL/TLS capabilities in their (embedded)
applications with as little hassle as possible.
FOSS License Exception: https://tls.mbed.org/foss-license-exception
--------------------------------------------------------------------------------
Update Information:
Mbed TLS 2.7.3 ============== Security -------- * (2.7, 2.1) Fixed an issue
in the X.509 module which could lead to a buffer overread during certificate
validation. Additionally, the issue could also lead to unnecessary callback
checks being made or to some validation checks to be omitted. The overread could
be triggered remotely, while the other issues would require a non DER-compliant
certificate to be correctly signed by a trusted CA, or a trusted CA with a non
DER-compliant certificate. Found by luocm. Fixes #825. * (2.7, 2.1) Fixed the
buffer length assertion in the ssl_parse_certificate_request() function which
could lead to an arbitrary overread of the message buffer. The overreads could
be caused by receiving a malformed algorithms section which was too short. In
builds with debug output, this overread data was output with the debug data. *
(2.7, 2.1) Fixed a client-side bug in the validation of the server's ciphersuite
choice which could potentially lead to the client accepting a ciphersuite it
didn't offer or a ciphersuite that could not be used with the TLS or DTLS
version chosen by the server. This could lead to corruption of internal data
structures for some configurations. Bugfix ------ * (2.7) Fixed a spurious
uninitialized variable warning in cmac.c. Fix independently contributed by Brian
J Murray and David Brown. * (2.7, 2.1) Added missing dependencies in test
suites that led to build failures in configurations that omit certain hashes or
public-key algorithms. Fixes #1040. * (2.7) Fixed a C89 incompatibility issue
in benchmark.c. Contributed by Brendan Shanks. Fixes #1353. * (2.7, 2.1) Added
missing dependencies for MBEDTLS_HAVE_TIME_DATE and MBEDTLS_VERSION_FEATURES in
some test suites. Contributed by Deomid Ryabkov. Fixes #1299, #1475. * (2.7,
2.1) Fixed the Makefile build process for building shared libraries on Mac OS X.
Fixed by mnacamura. * (2.7, 2.1) Fixed parsing of PKCS#8 encoded Elliptic
Curve keys. Previously Mbed TLS was unable to parse keys which had only the
optional parameters field of the ECPrivateKey structure. Found by Jethro
Beekman, fixed in #1379. * (2.7, 2.1) Added an optimisation to return the
plaintext data more quickly on unpadded CBC decryption, as stated in the
mbedtls_cipher_update() documentation. Contributed by Andy Leiserson. * (2.7,
2.1) Fixed the overriding and ignoring of return values when parsing and writing
to a file in the pk_sign program. Found by kevlut in #1142. * (2.7, 2.1) Fixed
buffer length assertions in the ssl_parse_certificate_request() function which
led to a potential one byte overread of the message buffer. * (2.7, 2.1) Fixed
invalid buffer sizes being passed to zlib during record compression and
decompression. Changes ------- * (2.7) Added support for cmake builds where
Mbed TLS is a subproject. Fix contributed independently by Matthieu Volat and
Arne Schwabe. * (2.7, 2.1) Improved the testing of configurations that omit
certain hashes or public-key algorithms. Includes contributions by Gert van
Dijk. * (2.7, 2.1) Improved negative testing of X.509 parsing. * (2.7, 2.1)
Does not define global mutexes for readdir() and gmtime() in configurations
where the feature is disabled. Found and fixed by Gergely Budai. * (2.7, 2.1)
Provided an empty implementation of mbedtls_pkcs5_pbes2() when
MBEDTLS_ASN1_PARSE_C is not enabled. This allows the use of PBKDF2 without
PBES2. Fixed by Marcos Del Sol Vives. * (2.7, 2.1) Improved the documentation
of mbedtls_net_accept(). Contributed by Ivan Krylov. * (2.7, 2.1) Improved the
documentation of mbedtls_ssl_write(). Suggested by Paul Sokolovsky in #1356. *
(2.7, 2.1) Added an option in the Makefile to support ar utilities where the
operation letter must not be prefixed by '-', such as LLVM. Found and fixed by
Alex Hixon. * (2.7, 2.1) Added the ability to allow configuration of the
shared library extension by setting the DLEXT environment variable when using
the project makefiles. * (2.7, 2.1) Changed the SSL module, such that when
f_send, f_recv or f_recv_timeout report transmitting more than the required
length, they now return an error. Raised by Sam O'Connor in #1245. * (2.7,
2.1) Improved the robustness of mbedtls_ssl_derive_keys() against the use of
HMAC functions with non-HMAC ciphersuites. Independently contributed by Jiayuan
Chen. Fixes #1437.
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update mbedtls' at the command line.
For more information, refer to "YUM", available at
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/...
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------