Debian Bug report logs -
#972806
mbedtls security advisories: local side channel attacks
Reply or subscribe to this bug.
Toggle useless messages
Report forwarded
to debian-bugs-dist@lists.debian.org, gs-debian.org@gluelogic.com, team@security.debian.org, James Cowgill <jcowgill@debian.org>:
Bug#972806; Package src:mbedtls.
(Sat, 24 Oct 2020 05:27:03 GMT) (full text, mbox, link).
Acknowledgement sent
to Glenn Strauss <gs-debian.org@gluelogic.com>:
New Bug report received and forwarded. Copy sent to gs-debian.org@gluelogic.com, team@security.debian.org, James Cowgill <jcowgill@debian.org>.
(Sat, 24 Oct 2020 05:27:04 GMT) (full text, mbox, link).
Message #5 received at submit@bugs.debian.org (full text, mbox, reply):
Source: mbedtls
Version: 2.16.0-1
Severity: serious
Tags: security
Justification: security
Dear Maintainer,
Mbed TLS 2.16.8 released 1 Sep 2020 addresses 3 security advisories
==> Please update mbedtls in all active Debian releases. Thank you.
https://github.com/ARMmbed/mbedtls/releases
https://tls.mbed.org/tech-updates/security-advisories
Local side channel attack on classical CBC decryption in (D)TLS
https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-09-1
CVE-2020-16150
Severity: High
Local side channel attack on RSA and static Diffie-Hellman
https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-09-2
Severity: High
Protocol weakness in DHE-PSK key exchange
https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-09-3
Severity: Low
-- System Information:
Debian Release: 10.6
APT prefers stable
APT policy: (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 4.19.0-12-amd64 (SMP w/1 CPU core)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Information forwarded
to debian-bugs-dist@lists.debian.org, James Cowgill <jcowgill@debian.org>:
Bug#972806; Package src:mbedtls.
(Sat, 24 Oct 2020 05:42:02 GMT) (full text, mbox, link).
Acknowledgement sent
to Glenn Strauss <gs-debian.org@gluelogic.com>:
Extra info received and forwarded to list. Copy sent to James Cowgill <jcowgill@debian.org>.
(Sat, 24 Oct 2020 05:42:02 GMT) (full text, mbox, link).
Message #10 received at 972806@bugs.debian.org (full text, mbox, reply):
Earlier this year, an issue was filed for security advisories in April:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=963159
Added tag(s) upstream.
Request was from Salvatore Bonaccorso <carnil@debian.org>
to control@bugs.debian.org.
(Sat, 24 Oct 2020 06:42:03 GMT) (full text, mbox, link).
Send a report that this bug log contains spam.
Debian bug tracking system administrator <owner@bugs.debian.org>.
Last modified:
Mon Nov 16 09:04:57 2020;
Machine Name:
buxtehude
Debian Bug tracking system
Debbugs is free software and licensed under the terms of the GNU
Public License version 2. The current version can be obtained
from https://bugs.debian.org/debbugs-source/.
Copyright © 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson,
2005-2017 Don Armstrong, and many other contributors.
Vulmon