diff options
| author | Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk> | 2017-09-01 19:04:29 +0100 |
|---|---|---|
| committer | Stijn Tintel <stijn@linux-ipv6.be> | 2017-09-11 01:56:14 +0200 |
| commit | 69ac637fbbc3fedb7fd9bd12cddd47b1e3875766 (patch) | |
| tree | 94d71ee7e9b4905d6a404d6feea010407ab5fcf2 /package/libs/mbedtls/Makefile | |
| parent | 21014d9708d586becbd62da571effadb488da9fc (diff) | |
| download | upstream-69ac637fbbc3fedb7fd9bd12cddd47b1e3875766.tar.gz upstream-69ac637fbbc3fedb7fd9bd12cddd47b1e3875766.tar.bz2 upstream-69ac637fbbc3fedb7fd9bd12cddd47b1e3875766.zip | |
mbedtls: update to 2.6.0 CVE-2017-14032
Fixed an authentication bypass issue in SSL/TLS. When the TLS
authentication mode was set to 'optional',
mbedtls_ssl_get_verify_result() would incorrectly return 0 when the
peer's X.509 certificate chain had more than
MBEDTLS_X509_MAX_INTERMEDIATE_CA intermediates (default: 8), even when
it was not trusted. This could be triggered remotely on both the client
and server side. (Note, with the authentication mode set by
mbedtls_ssl_conf_authmode()to be 'required' (the default), the handshake
was correctly aborted).
Signed-off-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
Tested-by: Magnus Kroken <mkroken@gmail.com>
Diffstat (limited to 'package/libs/mbedtls/Makefile')
| -rw-r--r-- | package/libs/mbedtls/Makefile | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/package/libs/mbedtls/Makefile b/package/libs/mbedtls/Makefile index 4cceb743d5..0e3383150d 100644 --- a/package/libs/mbedtls/Makefile +++ b/package/libs/mbedtls/Makefile @@ -8,13 +8,13 @@ include $(TOPDIR)/rules.mk PKG_NAME:=mbedtls -PKG_VERSION:=2.5.1 +PKG_VERSION:=2.6.0 PKG_RELEASE:=1 PKG_USE_MIPS16:=0 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-gpl.tgz PKG_SOURCE_URL:=https://tls.mbed.org/download/ -PKG_HASH:=312f020006f0d8e9ede3ed8e73d907a629baf6475229703941769372ab0adee2 +PKG_HASH:=a99959d7360def22f9108d2d487c9de384fe76c349697176b1f22370080d5810 PKG_BUILD_PARALLEL:=1 PKG_LICENSE:=GPL-2.0+ |