MGASA-2020-0370 - Updated mbedtls packages fix security vulnerabilities

Publication date: 27 Sep 2020
URL: https://advisories.mageia.org/MGASA-2020-0370.html
Type: security
Affected Mageia releases: 7
CVE: CVE-2020-16150

mbedtls 2.16.8 fixes three security vulnerabilities which could affect earlier
releases:

Local side channel attack on classical CBC decryption in (D)TLS
(CVE-2020-16150).

Local side channel attack on RSA and static Diffie-Hellman.

Protocol weakness in DHE-PSK key exchange.

References:
- https://bugs.mageia.org/show_bug.cgi?id=27282
- https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-09-1
- https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-09-2
- https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-09-3
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16150

SRPMS:
- 7/core/mbedtls-2.16.8-1.mga7