Debian 11 DLA-4236-1 critical: mbedtls timing and denial of service issues

CVE-2021-24119

A side-channel vulnerability in base64 PEM file decoding allows
system-level (administrator) attackers to obtain information about
secret RSA keys via a controlled-channel and side-channel attack on
software running in isolated environments that can be single stepped,
especially Intel SGX.

CVE-2021-36647

Function mbedtls_mpi_exp_mod() in lignum.c in Mbed TLS Mbed TLS all
versions before 3.0.0, 2.27.0 or 2.16.11 allowed attackers with access
to precise enough timing and memory access information (typically an
untrusted operating system attacking a secure enclave such as SGX or
the TrustZone secure world) to recover the private keys used in RSA.

CVE-2021-43666

In the mbedtls_pkcs12_derivation function an input password's length
is 0 caused a denial of service.

CVE-2021-44732

Function mbedtls_ssl_set_session() performed a double free in certain
out-of-memory conditions.

CVE-2022-46392