Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 620504

Summary: net-libs/polarssl: Double free and MD5 signature issue (SLOTH)
Product: Gentoo Security Reporter: Thomas Deutschmann (RETIRED) <whissi>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: normal CC: tommy
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
URL: https://tls.mbed.org/tech-updates/releases/mbedtls-2.2.1-2.1.4-1.3.16-and-polarssl.1.2.19-released
See Also: https://bugs.gentoo.org/show_bug.cgi?id=571102
Whiteboard: B3 [glsa+]
Package list:
Runtime testing required: ---

Description Thomas Deutschmann (RETIRED) gentoo-dev 2017-06-03 12:38:58 UTC
From $URL:

(2.2, 2.1, 1.3) Fixes a potential double free when mbedtls_asn1_store_named_data() fails to allocate memory. This was only used for certificate generation and was not triggerable remotely in SSL/TLS. The original issues was found by Rafał Przywara, in https://github.com/ARMmbed/mbedtls/issues/367
    
(2.2, 2.1, 1.3) Disables by default MD5 handshake signatures in TLS 1.2 to prevent the SLOTH attack on TLS 1.2 server authentication (other attacks from the SLOTH paper do not apply to any version of mbed TLS or PolarSSL).
Comment 1 Christopher Díaz Riveros (RETIRED) gentoo-dev Security 2018-01-05 16:25:27 UTC
Added to existing GLSA.
Comment 2 GLSAMaker/CVETool Bot gentoo-dev 2018-01-15 04:28:35 UTC
This issue was resolved and addressed in
 GLSA 201801-15 at https://security.gentoo.org/glsa/201801-15
by GLSA coordinator Thomas Deutschmann (whissi).