CVE-2025-27809

Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client application calls mbedtls_ssl_set_hostname.

Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client application calls mbedtls_ssl_set_hostname.

Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client application calls mbedtls_ssl_set_hostname.

These are all security issues fixed in the libmbedcrypto7-2.28.10-1.1 package on the GA media of openSUSE Tumbleweed.

This update for mbedtls fixes the following issues:

Changes in mbedtls:

• Update to 3.6.6 (LTS maintenance update from 3.6.1); security fixes accumulated across the 3.6.2-3.6.6 releases:
  • CVE-2024-49195 (boo#1231708): buffer underrun in pkwrite when writing an opaque key pair
  • CVE-2025-27809 (boo#1240051): certificate verification accepted arbitrary hostnames
  • CVE-2025-27810 (boo#1240052): possible authentication bypass on failed memory allocation / hardware errors
  • CVE-2025-47917 (boo#1246783): misleading memory management in mbedtls_x509_string_to_names()
  • CVE-2025-48965 (boo#1246784): NULL pointer dereference after mbedtls_asn1_store_named_data()
  • CVE-2025-49087 (boo#1246973): timing side channel in PKCS#7 padding removal
  • CVE-2025-49600 (boo#1245808): unchecked return values in LMS verification allow signature bypass via fault injection
  • CVE-2025-49601 (boo#1245809): out-of-bounds read in mbedtls_lms_import_public_key()
  • CVE-2025-52496 (boo#1245810): race in AES-NI support detection can lead to AES key extraction or GCM forgery
  • CVE-2025-52497 (boo#1245811): one-byte heap underflow when parsing PEM-encrypted material
  • CVE-2025-54764 (boo#1252341): timing attacks in RSA operations
  • CVE-2025-59438 (boo#1252454): padding-oracle attack via timing of cipher error reporting
  • CVE-2026-25833: PSA RNG state duplicated across fork()
  • CVE-2026-25834: TLS 1.3 HelloRetryRequest man-in-the-middle session-resumption downgrade
  • CVE-2026-25835: RNG state duplicated when application/VM state is cloned

This update for mbedtls-2 fixes the following issues:

Changes in mbedtls-2:

• Enable SRTP and DTLS protocols needed by some software.

• Update to version 2.28.10: Default behavior changes

  • In TLS clients, if mbedtls_ssl_set_hostname() has not been called, mbedtls_ssl_handshake() now fails with MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME if certificate-based authentication of the server is attempted. This is because authenticating a server without knowing what name to expect is usually insecure. To restore the old behavior, either call mbedtls_ssl_set_hostname() with NULL as the hostname, or enable the new compile-time option MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME. The content of ssl->hostname after mbedtls_ssl_set_hostname(ssl, NULL) has changed, see the documentation of the hostname field in the mbedtls_ssl_context struct type for details. Security
  • Note that TLS clients should generally call mbedtls_ssl_set_hostname() if they use certificate authentication (i.e. not pre-shared keys). Otherwise, in many scenarios, the server could be impersonated. The library will now prevent the handshake and return MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME if mbedtls_ssl_set_hostname() has not been called. CVE-2025-27809 (boo#1240051)
  • Zeroize temporary heap buffers used in PSA operations.
  • Fix a vulnerability in the TLS 1.2 handshake. If memory allocation failed or there was a cryptographic hardware failure when calculating the Finished message, it could be calculated incorrectly. This would break the security guarantees of the TLS handshake. CVE-2025-27810 (boo#1240052) Bugfix
  • Use 'mbedtls_net_close' instead of 'close' in 'mbedtls_net_bind' and 'mbedtls_net_connect' to prevent possible double close fd problems. Fixes gh#Mbed-TLS/mbedtls#9711.
  • Fix compilation on MS-DOS DJGPP. Fixes gh#Mbed-TLS/mbedtls#9813.
  • Fix missing constraints on the AES-NI inline assembly which is used on GCC-like compilers when building AES for generic x86_64 targets. This may have resulted in incorrect code with some compilers, depending on optimizations. Fixes gh#Mbed-TLS/mbedtls#9819.
  • Fix issue where psa_key_derivation_input_integer() is not detecting bad state after an operation has been aborted.
  • Fix definition of MBEDTLS_PRINTF_SIZET to prevent runtime crashes that occurred whenever SSL debugging was enabled on a copy of Mbed TLS built with Visual Studio 2013 or MinGW. Fixes gh#Mbed-TLS/mbedtls#10017.
  • Remove Everest Visual Studio 2010 compatibility headers, which could shadow standard CRT headers inttypes.h and stdbool.h with incomplete implementatios if placed on the include path, eg. when building Mbed TLS with the .sln file shipped with the project.

Root has patched CVE-2025-27809 in the mbedtls package for Root:Debian:12. Multiple fixed versions available.