{"id":"MGASA-2024-0037","aliases":[],"status":"published","title":"Updated mbedtls packages fix security vulnerabilities","description":"This update brings the mbedtls packages from 2.28.3 to the latest 2.28.7\nrelease in the LTS branch, fixing a number of bugs as well the following\nsecurity vulnerabilities:\n- Buffer overread in TLS stream cipher suites.\n- Timing side channel in private key RSA operations.\n- Buffer overflow in mbedtls_x509_set_extension.\nSee the linked release notes for details.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2024-02-14T23:02:34Z","modified":"2026-04-16T04:23:12Z","fixes":[{"ecosystem":"Mageia:9","package":"mbedtls","fixed_in":["2.28.7-1.mga9"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:9","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28.7-1.mga9"}]}]}],"references":[{"url":"https://advisories.mageia.org/MGASA-2024-0037.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32844","tags":["report"]},{"url":"https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.4","tags":["web"]},{"url":"https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.5","tags":["web"]},{"url":"https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-2.28.5","tags":["web"]},{"url":"https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.6","tags":["web"]},{"url":"https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.7","tags":["web"]},{"url":"https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2023-10-1/","tags":["advisory"]},{"url":"https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-01-1/","tags":["advisory"]},{"url":"https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-01-2/","tags":["advisory"]}],"sources":{"osv":[{"id":"MGASA-2024-0037","title":"Updated mbedtls packages fix security vulnerabilities","description":"This update brings the mbedtls packages from 2.28.3 to the latest 2.28.7\nrelease in the LTS branch, fixing a number of bugs as well the following\nsecurity vulnerabilities:\n- Buffer overread in TLS stream cipher suites.\n- Timing side channel in private key RSA operations.\n- Buffer overflow in mbedtls_x509_set_extension.\nSee the linked release notes for details.\n","status":"published","published":"2024-02-14T23:02:34Z","modified":"2026-04-16T04:23:12.986266Z","updated_at":"2026-11-02T15:49:42.684501Z"}]}}