Stay Secure with the Latest Linux Advisories

security advisorydenial of servicecryptography

Mageia 7: 2020-0469 Moderate: Mbedtls Update Averts DoS Threats

This update provides security bug fixes and minor enhancements. Limit the size of calculations performed by mbedtls_mpi_exp_mod to MBEDTLS_MPI_MAX_SIZE to prevent a potential denial of service when generating Diffie-Hellman key pairs. . MGASA-2020-0469 - Updated mbedtls packages fix security vulnerabilities Publication date: 21 Dec 2020 URL: https://advisories.mageia.org/MGASA-2020-0469.html Type: security Affected Mageia releases: 7 This update provides security bug fixes and minor enhancements. Limit the size of calculations performed by mbedtls_mpi_exp_mod to MBEDTLS_MPI_MAX_SIZE to prevent a potential denial of service when generating Diffie-Hellman key pairs. A failure of the random generator was ignored in mbedtls_mpi_fill_random(), which is how most uses of randomization in asymmetric cryptography are implemented. This could cause failures or the silent use of non-random values. Fix a compliance issue whereby the library did not check the tag on the algorithm parameters (only the size) when comparing the signature in the description part of the cert to the real signature. Zeroising of local buffers and variables which are used for calculations in mbedtls_pkcs5_pbkdf2_hmac(), mbedtls_internal_sha*_process(), mbedtls_internal_md*_process() and mbedtls_internal_ripemd160_process() functions to erase sensitive data from memory. References: - https://bugs.mageia.org/show_bug.cgi?id=27869 - https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.16.9 SRPMS: - 7/core/mbedtls-2.16.9-1.mga7 . Recent improvements in mbedtls focus on adjusting limitations in key sizes and enhancing the random number generator to mitigate potential Denial of Service threats.. Mageia Security Update, mbedtls Enhancement, Denial of Service Prevention, Cryptography Security, Package Fixes. . Severity: Important. LinuxSecurity.com Team

Dec 21, 2020 •Important Mageia