Your message dated Wed, 14 Feb 2018 13:00:12 +0000
with message-id <[email protected]>
and subject line Bug#890287: fixed in mbedtls 2.7.0-1
has caused the Debian Bug report #890287,
regarding mbedtls: CVE-2018-0488 - Risk of remote code execution when truncated
HMAC is enabled
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
890287: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=890287
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: mbedtls
Version: 2.1.2-1
Severity: grave
Tags: security
https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-01
Vulnerability
When the truncated HMAC extension is enabled and CBC is used, sending a
malicious application packet can be used to selectively corrupt 6 bytes
on the peer's heap, potentially leading to a crash or remote code
execution. This can be triggered remotely from either side in both TLS
and DTLS.
If the truncated HMAC extension, which can be set by the compile time
option MBEDTLS_SSL_TRUNCATED_HMAC in config.h, is disabled when
compiling the library, then the vulnerability is not present. The
truncated HMAC extension is enabled in the default configuration.
The vulnerability is only present if
* The compile-time option MBEDTLS_SSL_TRUNCATED_HMAC is set in config.h.
(It is set by default) AND
* The truncated HMAC extension is explicitly offered by calling
mbedtls_ssl_conf_truncated_hmac(). (It is not offered by default)
Impact
Depending on the platform, an attack exploiting this vulnerability could
lead to an application crash or allow remote code execution.
Resolution
Affected users should upgrade to Mbed TLS 1.3.22, Mbed TLS 2.1.10 or
Mbed TLS 2.7.0.
Workaround
Users should wherever possible upgrade to the newer version of Mbed TLS.
Where this is not practical, users should consider disabling the
truncated HMAC extension by removing any call to
mbedtls_ssl_conf_truncated_hmac() in their application, and the option
MBEDTLS_SSL_TRUNCATED_HMAC in the Mbed TLS configuration is practical
for their application.
signature.asc
Description: OpenPGP digital signature
--- End Message ---
--- Begin Message ---
Source: mbedtls
Source-Version: 2.7.0-1
We believe that the bug you reported is fixed in the latest version of
mbedtls, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
James Cowgill <[email protected]> (supplier of updated mbedtls package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 14 Feb 2018 09:25:58 +0000
Source: mbedtls
Binary: libmbedtls-dev libmbedcrypto1 libmbedtls10 libmbedx509-0 libmbedtls-doc
Architecture: source amd64 all
Version: 2.7.0-1
Distribution: experimental
Urgency: medium
Maintainer: James Cowgill <[email protected]>
Changed-By: James Cowgill <[email protected]>
Description:
libmbedcrypto1 - lightweight crypto and SSL/TLS library - crypto library
libmbedtls-dev - lightweight crypto and SSL/TLS library - development files
libmbedtls-doc - lightweight crypto and SSL/TLS library - documentation
libmbedtls10 - lightweight crypto and SSL/TLS library - tls library
libmbedx509-0 - lightweight crypto and SSL/TLS library - x509 certificate
library
Closes: 890287 890288
Changes:
mbedtls (2.7.0-1) experimental; urgency=medium
.
* New upstream release.
- Fixes CVE-2018-0488. (Closes: #890287)
- Fixes CVE-2018-0487. (Closes: #890288)
* Rename libmbedcrypto0 to libmbedcrypto1 due to SONAME bump.
.
* debian/compat:
- Use debhelper compat 11.
* debian/control:
- Switch to salsa.debian.org Vcs URLs.
- Bump standards version to 4.1.3.
- Drop useless Testsuite field in debian/control.
* debian/copyright:
- Update copyright dates.
* debian/libmbedtls-doc.*:
- Fix various paths to work with the new documentation location used
by debhelper 11.
* debian/patches:
- Refresh config patch.
* debian/*.symbols:
- Add symbols updates for libmbedtls10.
- Rewrite symbols libmbedcrypto1 symbols file.
Checksums-Sha1:
a8d1f6702d69006801e97d778983033ec95c3a7d 2163 mbedtls_2.7.0-1.dsc
01ffebf679c8696cc941c41224fa73d8944d2c85 2108442 mbedtls_2.7.0.orig.tar.gz
057da4c0aefaeee4495fe54712976a6afe7788de 11332 mbedtls_2.7.0-1.debian.tar.xz
ca6eebb2f885ad21a9b2510f98a6cc9688db673e 323092
libmbedcrypto1-dbgsym_2.7.0-1_amd64.deb
f892d3210b1b9a80181a48af0f4241d739ee9d26 183096
libmbedcrypto1_2.7.0-1_amd64.deb
5469576c7fddd83484fc0e89298bb41507c3ec9f 424808
libmbedtls-dev_2.7.0-1_amd64.deb
3d6d244caab24bc77446409ce38692cf3faf7443 4541844 libmbedtls-doc_2.7.0-1_all.deb
3f9235c96d68374939704ee3b0542c932dd9b742 146500
libmbedtls10-dbgsym_2.7.0-1_amd64.deb
40b8e82b819a139974d2eab8d8c9a6ea7025a547 111456 libmbedtls10_2.7.0-1_amd64.deb
9cf84059179981c6cd135c469e6b7f923c57f357 61244
libmbedx509-0-dbgsym_2.7.0-1_amd64.deb
aa5cfea1405a81cd21f58c22f04ce3f29ed74fa3 78536 libmbedx509-0_2.7.0-1_amd64.deb
a609adfafc66959c5d948629ec17105e792a66ff 9833 mbedtls_2.7.0-1_amd64.buildinfo
Checksums-Sha256:
1c9556d6bf22761b8ca982b365d7efefdb4428c84d6e67e8b192dde9b3d7250a 2163
mbedtls_2.7.0-1.dsc
aeb66d6cd43aa1c79c145d15845c655627a7fc30d624148aaafbb6c36d7f55ef 2108442
mbedtls_2.7.0.orig.tar.gz
aecd74c56486f773c6a3dd452f2daa2c8e6eec05a2ed9032e252c2ce901a8a2c 11332
mbedtls_2.7.0-1.debian.tar.xz
3472bd95181aed7f1a5259837aa9a8cf3a8e0d67053d3756d8adc7eee87388eb 323092
libmbedcrypto1-dbgsym_2.7.0-1_amd64.deb
76dc79faeb0103278aa3e37d839273aaf920103d76590c32fc0006a9981f4695 183096
libmbedcrypto1_2.7.0-1_amd64.deb
3a87f81573fd5771936aee2848972bbf1c294f7b4d8464bd0b41cd42006b5dce 424808
libmbedtls-dev_2.7.0-1_amd64.deb
6c9c4a03ff2be8fb462770c219aa4c543d4cbde078e612f38c75802a8b511b8a 4541844
libmbedtls-doc_2.7.0-1_all.deb
1198f5d4003e1e78dbc7eb3399c59fc5a5ea6c90baa58cfae835e6edd494fc40 146500
libmbedtls10-dbgsym_2.7.0-1_amd64.deb
dd3a7b442da338e20efb8cf86c5d4ae24f5b25a89884ead83773a79e399bc7da 111456
libmbedtls10_2.7.0-1_amd64.deb
4f968cfce8cc9b5be9c813cf66ead435210eb12e038a80326cbbffcf7b533fa7 61244
libmbedx509-0-dbgsym_2.7.0-1_amd64.deb
55c8e78f4e3cd6f1256b10b62c39320b90debf8cbcb8054aee5bd99a33d77305 78536
libmbedx509-0_2.7.0-1_amd64.deb
ad360613d629cd03b9613f3c3c46c74310bf3633c913cbece79834cda7ad2dd0 9833
mbedtls_2.7.0-1_amd64.buildinfo
Files:
eefd509700d0672ce213ad19c44046a1 2163 libs optional mbedtls_2.7.0-1.dsc
0c2fc845da79b799c112e3ffdf6e75b4 2108442 libs optional
mbedtls_2.7.0.orig.tar.gz
ae6da759d8b24de1280a90150f98615b 11332 libs optional
mbedtls_2.7.0-1.debian.tar.xz
3653c95c92a26861a1de4d6a2d757bf7 323092 debug optional
libmbedcrypto1-dbgsym_2.7.0-1_amd64.deb
6900e633a0061e9df40518bad0c7d496 183096 libs optional
libmbedcrypto1_2.7.0-1_amd64.deb
458cca9c6d3c87f9282749cefeeb4214 424808 libdevel optional
libmbedtls-dev_2.7.0-1_amd64.deb
eaf2f5c3a27784eba6a2b4af2c636b51 4541844 doc optional
libmbedtls-doc_2.7.0-1_all.deb
35162614818f9a8ec521b5b670028193 146500 debug optional
libmbedtls10-dbgsym_2.7.0-1_amd64.deb
ec2b1ec55dfd3e44677f6e8acfa81155 111456 libs optional
libmbedtls10_2.7.0-1_amd64.deb
a9c72ee492ee960a44244cd041943ef8 61244 debug optional
libmbedx509-0-dbgsym_2.7.0-1_amd64.deb
cac0ba26c2bf5f5e055ffbf20363f569 78536 libs optional
libmbedx509-0_2.7.0-1_amd64.deb
038fd1e80b608bfcb504102620f4d906 9833 libs optional
mbedtls_2.7.0-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE+Ixt5DaZ6POztUwQx/FnbeotAe8FAlqEDxIACgkQx/Fnbeot
Ae868g//byhqmIbsF+/IBgszro59kpYTJZOfOXLEo6DxYpWsQbkZt5d6lyvLfSKC
r1HUuyqVNj8F7SFK33sdC+HYfBLcbsrjP2BmGw5nwqt3rkPNUsDiGnJN6ICLL+nc
yiQAe2IAtMNJlJ1kx6wPlefPzBx4UrFXt52WrMJSOd0uRlkAssoJx3bIZNoUdjRZ
lApuhIO5I42ung6sfmZDHXSrcJB/K21fmfvyC7+kKaA2cvbMxcMAjP3KuE5PU0Lv
6t+zr/HuNl1CVZD/KHMPIsuEKCuCdOjaT3g3xCG3T42bvpikC9Dk6VLjsYniZecE
j0Md74It+H/fkBl3+RPXWm42pt9cWTisB0RuevpW4noGeLUpw9h/R1/ePpkcCdqq
B4JtnIoKBk6v/VwGdZGX9CRXw2RPMfgy8QiDLnhMjDdIoa4YYHwwwnFrfWTVb+V5
1szkETZEDZVhH8Jjc7BSUAJdAysSBI0XIZEAxx/ENeLF9TaEvKEWsQ70U1z9n1Be
dQB5XMLUpbivh4gqBH/sZFsYi0Y9jdlGPW25Cu8QieE2K3/6TnzSmTOB9SaFG5rV
m9i4nV6mlDvFIksmrPTY7kIg+lC1IPo6G3Qfo954JN+8RMKNrOmM8DPWriXLKTFK
VGloJHp2v0aQlTmk3DKUSZ+/Gwb/HJItgTVg4eajCsos+9+DXDw=
=4Q2m
-----END PGP SIGNATURE-----
--- End Message ---
