Skip to content

Mbed TLS 2.28.7
Compare
Choose a tag to compare
@daverodgman daverodgman released this 26 Jan 10:18
· 614 commits to mbedtls-2.28 since this release
v2.28.7
555f847

Description

This release of Mbed TLS provides bug fixes and minor enhancements. This release includes fixes for security issues.

Mbed TLS 2.28 is a long-time support branch. It will be supported with bug-fixes and security fixes until end of 2024.

Security Advisories

For full details, please see the following links:

Release Notes

Security

  • Fix a timing side channel in private key RSA operations. This side channel
    could be sufficient for an attacker to recover the plaintext. A local
    attacker or a remote attacker who is close to the victim on the network
    might have precise enough timing measurements to exploit this. It requires
    the attacker to send a large number of messages for decryption. For
    details, see "Everlasting ROBOT: the Marvin Attack", Hubert Kario. Reported
    by Hubert Kario, Red Hat.
  • Fix a failure to validate input when writing x509 extensions lengths which
    could result in an integer overflow, causing a zero-length buffer to be
    allocated to hold the extension. The extension would then be copied into
    the buffer, causing a heap buffer overflow.

Who should update

We recommend all users should update to take advantage of the bug fixes contained in this release at an appropriate point in their development lifecycle.

Checksum

The SHA256 hashes for the archives are:

4390bc4ab1ea9a1ddf3725f540d0f80838c656d1d7987a1cee8b4da43e4571de mbedtls-2.28.7.tar.gz
1df6073f0cf6a4e1953890bf5e0de2a8c7e6be50d6d6c69fa9fefcb1d14e981a v2.28.7.tar.gz

12f6e95435aa7510f74938fb1464d58c569c4b298b7044b7940758bbf6d5da04 mbedtls-2.28.7.zip
527ff2472f6c51436808242f4b626500555145a472ca0a2f30a3e68d52d9806e v2.28.7.zip

The URLs below point to the archives named vX.Y.Z.... When checking hashes, please be aware that due to GitHub's use of the Content-Disposition header, some clients will download the vX.Y.Z... archive and save it with the filename mbedtls-X.Y.Z....

Assets 2