Date: Fri, 10 Apr 2026 16:45:32 +0000 From: Yusuf Yaman <nxjoseph@FreeBSD.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org Subject: git: 1a38d8fb7aef - main - security/vuxml: Add MbedTLS vulnerabilities Message-ID: <69d9292c.24cc5.64d84136@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch main has been updated by nxjoseph: URL: https://cgit.FreeBSD.org/ports/commit/?id=1a38d8fb7aefaafa50ce7f39a7de7b721785c2ab commit 1a38d8fb7aefaafa50ce7f39a7de7b721785c2ab Author: Yusuf Yaman <nxjoseph@FreeBSD.org> AuthorDate: 2026-04-10 15:41:29 +0000 Commit: Yusuf Yaman <nxjoseph@FreeBSD.org> CommitDate: 2026-04-10 16:39:52 +0000 security/vuxml: Add MbedTLS vulnerabilities Reviewed by: osa, vvd (mentors) Approved by: osa (mentor) Differential Revision: https://reviews.freebsd.org/D56344 --- security/vuxml/vuln/2026.xml | 52 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 52 insertions(+) diff --git a/security/vuxml/vuln/2026.xml b/security/vuxml/vuln/2026.xml index 85c1c149bcc4..c6256911035d 100644 --- a/security/vuxml/vuln/2026.xml +++ b/security/vuxml/vuln/2026.xml @@ -1,3 +1,55 @@ + <vuln vid="d77bd2f5-34f0-11f1-bc6d-3c7c3fba4204"> + <topic>Mbed TLS -- vulnerabilities</topic> + <affects> + <package> + <name>mbedtls3</name> + <range><lt>3.6.6</lt></range> + </package> + <package> + <name>mbedtls4</name> + <range><lt>4.1.0</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>https://mbed-tls.readthedocs.io/en/latest/security-advisories/ reports:</p> + <blockquote cite="https://mbed-tls.readthedocs.io/en/latest/security-advisories/">; + <ul> + <li>Client impersonation while resuming a TLS 1.3 session (CVE-2026-34873)</li> + <li>Entropy on Linux can fall back to /dev/urandom (CVE-2026-34871)</li> + <li>PSA random generator cloning (CVE-2026-25835)</li> + <li>Compiler-induced constant-time violations (CVE-2025-66442)</li> + <li>Null pointer dereference when setting a distinguished name (CVE-2026-34874)</li> + <li>Buffer overflow in FFDH public key export (CVE-2026-34875)</li> + <li>FFDH: lack of contributory behaviour due to improper input validation (CVE-2026-34872)</li> + <li>Signature Algorithm Injection (CVE-2026-25834)</li> + <li>CCM multipart finish tag-length validation bypass (CVE-2026-34876)</li> + <li>Risk of insufficient protection of serialized session or context data leading to potential memory safety issues (CVE-2026-34877)</li> + <li>Buffer underflow in x509_inet_pton_ipv6() (CVE-2026-25833)</li> + </ul> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2026-34873</cvename> + <cvename>CVE-2026-34871</cvename> + <cvename>CVE-2026-25835</cvename> + <cvename>CVE-2025-66442</cvename> + <cvename>CVE-2026-34874</cvename> + <cvename>CVE-2026-34875</cvename> + <cvename>CVE-2026-34872</cvename> + <cvename>CVE-2026-25834</cvename> + <cvename>CVE-2026-34876</cvename> + <cvename>CVE-2026-34877</cvename> + <cvename>CVE-2026-25833</cvename> + <url>https://mbed-tls.readthedocs.io/en/latest/security-advisories/</url>; + </references> + <dates> + <discovery>2026-03-31</discovery> + <entry>2026-04-10</entry> + </dates> + </vuln> + <vuln vid="4b727a1a-5034-42b4-b29b-2289389f4ba8"> <topic>chromium -- security fixes</topic> <affects>home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?69d9292c.24cc5.64d84136>