Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2017.2277
mbedtls security update
11 September 2017
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: mbedtls
Publisher: Debian
Operating System: Debian GNU/Linux 9
Linux variants
Impact/Access: Provide Misleading Information -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2017-14032
Original Bulletin:
http://www.debian.org/security/2017/dsa-3967
Comment: This advisory references vulnerabilities in products which run on
platforms other than Debian. It is recommended that administrators
running mbedtls check for an updated version of the software for
their operating system.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-3967-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
September 08, 2017 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : mbedtls
CVE ID : CVE-2017-14032
Debian Bug : 873557
An authentication bypass vulnerability was discovered in mbed TLS, a
lightweight crypto and SSL/TLS library, when the authentication mode is
configured as 'optional'. A remote attacker can take advantage of this
flaw to mount a man-in-the-middle attack and impersonate an intended
peer via an X.509 certificate chain with many intermediates.
For the stable distribution (stretch), this problem has been fixed in
version 2.4.2-1+deb9u1.
For the testing distribution (buster), this problem has been fixed
in version 2.6.0-1.
For the unstable distribution (sid), this problem has been fixed in
version 2.6.0-1.
We recommend that you upgrade your mbedtls packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlmy4/ZfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0QFAhAAiBgQET252p6Ab0BTpPrfb38NBPp3zyFnkl/5X06fWTqsNhuaASEzZt/S
KOajEbcUtpe6lA0NqxGGviqDeA+moS5M/rwXkc4wh+cgZV0Dq7DxURdEenF2ly1J
Q4h04AJohM5155epBB1aS/9oP1IBgT9P6lUyM/VshS5JsfVFuZ1LNmxRyIRarCLG
y6j77BJgazhIXWEGVVbMBBpPIOeVAJavFoJ2Ppo1/ehlPeJe+Zug/xcHZQY1Cm07
sdx+h/8rtDViK56aTLAKwIXTi2pn82QteqwdyBdC/VWTapzZc/bLtx7Q2S9fCUcu
72oUC1F62IMBbdL8sXuunKQl1WrIRQW3K/Suhf/c3RTx3tdz0pMo97iNZzUsXFgW
rux8eMat1c5+57JoOLonEKzU5d54R/kktwiJPnzY9HMhl5meLyXnv1bxgDvqNrts
ncn1dPgXyRI9bMrntpL/0f+3hRgRc1JVqUbzg2h3S1mZiFfxo11BiigC24be2kPS
w2CCBTZCevyvti/4Kg+lsA8XwWWVcBbUC2AYFvUcrqlORMDFiY0xqRVpO6KChUNr
yWxczuG2cUTL1YxefXkfTOowgHa5/qdw3KInCQYMWFBL/gcMcbAj0j4sJbAvvDbT
M2U8AceGgXfG0yfqetWpr6shpoFXjGh/R1YRAGNAbHDiaZru5Wk=
=9wmA
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWbXEIIx+lLeg9Ub1AQjVgQ/9FBEj/HvRxnDxPdyH3fMK8IuVAK2hnPga
+qXM/QXpspZnh8Ww/KtpXnElgEZ8QqUl2oTASAyj2BaI/jExpEEf4wt+wlzwnWVS
IcnpIQZo1W1p+V4XZDtt6tXPctlRs9bIWVYuOkXw1XG/Mxer7lPLWmQzJkwjLc5w
MkdgR6pWr/tEt1mWUl1owViGeqRTdmjXJ53nmZqapayNHmFvYU7j4ApqIQolTyFK
hl70S7KZlaOcWxsdH14hztHsWAayFst7DIgZgIDBe6GJ3vBcIG57Pn116qB9oFpa
nkxU7nJLn5ISl2kLUSCsbLo+tS+6ixETmv37qj6WDsN/tV/3FBeHq2m2ppy3ZIYi
eF6pqZtKxGK9u7RsIffda7DDbSWvOI4v+ylnkSAAgiQSLS1liqQoWZWeePG0Tz0S
1PV5sBpIUDtUfv8vq9TUAGAzrXMaR1up8RSKMa21x5Ayb3L9/h/FGwJjJTiSPZox
GlVbJThpwXK7zMjIzhbW/rbEi5VdTT7pGQTFQVrcZ4aObe47CuBuaMn2KAmuQiba
BfwlCzIYdQg7yEGf5bnLSnGCIzMr1f/TxoMZYLNDlhQ/aZ9s0N26s+DqJqc5EDgV
w50Ak+vfk5y2Qhj6f4AwQ+oWuFFVIj7ff4dPXWRh5pPTAUoXGlJ3mwTBIaOQOp7j
80qmervG3Ck=
=wGyF
-----END PGP SIGNATURE-----