mbedtls has released updated versions that fix a double free vuln and an MD5 signature issue related to the SLOTH attack: https://tls.mbed.org/tech-updates/releases/mbedtls-2.2.1-2.1.4-1.3.16-and-polarssl.1.2.19-released Here's the info about the SLOTH attack: http://www.mitls.org/pages/attacks/SLOTH polarssl (the older name of mbedtls) is also affected, Gentoo currently still has an ebuild for polarssl 1.3.9. While upstream released an update for an old polarssl branch (1.2.19), there seems to be no update for polarssl 1.3.9. So polarssl probably should be removed completely.
all <net-libs/mbedtls-2.2.1 ebuilds are off the tree. however all the polarssl ebuilds are vulnerable. we should mask polarssl for removal. @tommy do you want to take care of polarssl since its your package.
The remaining packages depending on polarssl have open bugs assigned, bug 618354 tracks them.
I split out net-libs/polarssl into bug 620504. SLOTH issue is CVE-2015-7575. Added to an existing GLSA.
This issue was resolved and addressed in GLSA 201706-18 at https://security.gentoo.org/glsa/201706-18 by GLSA coordinator Kristian Fiskerstrand (K_F).
