MGASA-2024-0037

Updated mbedtls packages fix security vulnerabilities

No scoreFix available

This update brings the mbedtls packages from 2.28.3 to the latest 2.28.7 release in the LTS branch, fixing a number of bugs as well the following security vulnerabilities:

Buffer overread in TLS stream cipher suites.
Timing side channel in private key RSA operations.
Buffer overflow in mbedtls_x509_set_extension. See the linked release notes for details.

What each source reports

OSV No score

Updated mbedtls packages fix security vulnerabilities

This update brings the mbedtls packages from 2.28.3 to the latest 2.28.7 release in the LTS branch, fixing a number of bugs as well the following security vulnerabilities:

Buffer overread in TLS stream cipher suites.
Timing side channel in private key RSA operations.
Buffer overflow in mbedtls_x509_set_extension. See the linked release notes for details.

Record: MGASA-2024-0037
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`mbedtls` Mageia:9	before 2.28.7-1.mga9	2.28.7-1.mga9

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

MGASA-2024-0037 is a vulnerability with no CVSS score yet in mbedtls, published February 14, 2024. No source lists public exploit code. Fixed in mbedtls 2.28.7-1.mga9.

References

Show 4 moreShow less