Upstream has issued an advisory on July 1: https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-07 The issue is fixed upstream in 2.16.7. Mageia 7 is also affected.
Whiteboard: (none) => MGA7TOO
Status: NEW => ASSIGNED
mbedtls-2.16.7-1.mga8 pushed to Cauldron. Advisory for mga7: ================== Updated mbedtls packages fix security vulnerabilities Fix a side channel vulnerability in modular exponentiation that could reveal an RSA private key used in a secure enclave. Fix side channel in mbedtls_ecp_check_pub_priv() and mbedtls_pk_parse_key() / mbedtls_pk_parse_keyfile() (when loading a private key that didn't include the uncompressed public key), as well as mbedtls_ecp_mul() / mbedtls_ecp_mul_restartable() when called with a NULL f_rng argument. An attacker with access to precise enough timing and memory access information (typically an untrusted operating system attacking a secure enclave) could fully recover the ECC private key. Fix issue in Lucky 13 counter-measure that could make it ineffective when hardware accelerators were used (using one of the MBEDTLS_SHAxxx_ALT macros). This would cause the original Lucky 13 attack to be possible in those configurations, allowing an active network attacker to recover plaintext after repeated timing measurements under some conditions. References: - https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-07 - https://github.com/ARMmbed/mbedtls/releases/tag/mbedtls-2.16.7 SRPM in core/updates_testing: ============================= mbedtls-2.16.7-1.mga7 RPMs in core/updates_testing: ============================= lib64mbedcrypto3-2.16.7-1.mga7 lib64mbedtls12-2.16.7-1.mga7 lib64mbedtls-devel-2.16.7-1.mga7 lib64mbedx509_0-2.16.7-1.mga7 mbedtls-2.16.7-1.mga7 Testing procedure: ================== This can be tested via the SSL support feature of applications using mbedtls, notably: - dolphin-emu - godot - hiawatha - obs-studio mbedtls will be used when e.g. resolving a HTTPS URL. In Godot, this can be done by browsing its Asset Library (all images and descriptions should be served over HTTPS). Note that Godot requires OpenGL 2.1 support, so might not work well in a VM.
Assignee: rverschelde => qa-bugs
Whiteboard: MGA7TOO => (none)Version: Cauldron => 7
mga7, x86_64 Installed the updated packages and started godot from the command-line. Imported a couple of projects, selected templates and browsed the asset library. Installed some of the libraries and ended up in the editor. All working smoothly. Installed hiawatha. # systemctl stop httpd # systemctl enable hiawatha # systemctl start hiawatha # systemctl status hiawatha ● hiawatha.service - Hiawatha Web Server Loaded: loaded (/usr/lib/systemd/system/hiawatha.service; enabled; vendor pr> Active: active (running) since Wed 2020-07-08 23:27:11 BST; 11s ago Process: 17723 ExecStartPre=/usr/sbin/wigwam (code=exited, status=0/SUCCESS) Pointing firefox at localhost showed the "installation successful" page. Tried some secure sites like thelogin page for personal banking, Mageia Bugzilla and the login page for my housing association. Logged in successfully. Green light for this one.
Whiteboard: (none) => MGA7-64-OKCC: (none) => tarazed25
Validating. Advisory in Comment 1.
CC: (none) => andrewsfarm, sysadmin-bugsKeywords: (none) => validated_update
Keywords: (none) => advisoryCC: (none) => mageia
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2020-0293.html
Status: ASSIGNED => RESOLVEDResolution: (none) => FIXED
CVE-2020-10941 was fixed in this update: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/5JPE2HFBDJF3UBT6Q4VWLKNKCVCMX25J/
Summary: mbedtls new security issues fixed upstream in 2.16.7 => mbedtls new security issues fixed upstream in 2.16.7 (CVE-2020-10941)