From 22ae52fa03241bbb47461bbf9d478dd89aeae535 Mon Sep 17 00:00:00 2001 From: Magnus Kroken Date: Sat, 25 Jan 2020 18:33:41 +0100 Subject: [PATCH] mbedtls: update to 2.16.4 Fixes side channel vulnerabilities in mbed TLS' implementation of ECDSA. Release announcement: https://tls.mbed.org/tech-updates/releases/mbedtls-2.16.4-and-2.7.13-released Security advisory: https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2019-12 Fixes: * CVE-2019-18222: Side channel attack on ECDSA Signed-off-by: Magnus Kroken (cherry picked from commit 6e96fd90471a49185bcfe9dcb4844d444674ecab) --- package/libs/mbedtls/Makefile | 4 +- package/libs/mbedtls/patches/200-config.patch | 44 +++++++++---------- 2 files changed, 24 insertions(+), 24 deletions(-) diff --git a/package/libs/mbedtls/Makefile b/package/libs/mbedtls/Makefile index 307d03432e..618a74703a 100644 --- a/package/libs/mbedtls/Makefile +++ b/package/libs/mbedtls/Makefile @@ -8,13 +8,13 @@ include $(TOPDIR)/rules.mk PKG_NAME:=mbedtls -PKG_VERSION:=2.16.3 +PKG_VERSION:=2.16.4 PKG_RELEASE:=1 PKG_USE_MIPS16:=0 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-gpl.tgz PKG_SOURCE_URL:=https://tls.mbed.org/download/ -PKG_HASH:=fd01fe4b289116df7781d05e1ef712b6c98823c5334f4a27404f13a8d066ef6a +PKG_HASH:=5fdb9c43ab43fd9bcc3631508170b089ede7b86dd655253a93cb0ffeb42309f3 PKG_BUILD_PARALLEL:=1 PKG_LICENSE:=GPL-2.0+ diff --git a/package/libs/mbedtls/patches/200-config.patch b/package/libs/mbedtls/patches/200-config.patch index a09cf1f49b..298fa4aa79 100644 --- a/package/libs/mbedtls/patches/200-config.patch +++ b/package/libs/mbedtls/patches/200-config.patch @@ -17,7 +17,7 @@ /** * \def MBEDTLS_CIPHER_NULL_CIPHER -@@ -750,19 +750,19 @@ +@@ -757,19 +757,19 @@ * * Comment macros to disable the curve and functions for it */ @@ -46,7 +46,7 @@ /** * \def MBEDTLS_ECP_NIST_OPTIM -@@ -864,7 +864,7 @@ +@@ -871,7 +871,7 @@ * See dhm.h for more details. * */ @@ -55,7 +55,7 @@ /** * \def MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED -@@ -884,7 +884,7 @@ +@@ -891,7 +891,7 @@ * MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA * MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA */ @@ -64,7 +64,7 @@ /** * \def MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED -@@ -909,7 +909,7 @@ +@@ -916,7 +916,7 @@ * MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA * MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA */ @@ -73,7 +73,7 @@ /** * \def MBEDTLS_KEY_EXCHANGE_RSA_ENABLED -@@ -1043,7 +1043,7 @@ +@@ -1050,7 +1050,7 @@ * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 */ @@ -82,7 +82,7 @@ /** * \def MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED -@@ -1067,7 +1067,7 @@ +@@ -1074,7 +1074,7 @@ * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 */ @@ -91,7 +91,7 @@ /** * \def MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED -@@ -1171,7 +1171,7 @@ +@@ -1178,7 +1178,7 @@ * This option is only useful if both MBEDTLS_SHA256_C and * MBEDTLS_SHA512_C are defined. Otherwise the available hash module is used. */ @@ -100,7 +100,7 @@ /** * \def MBEDTLS_ENTROPY_NV_SEED -@@ -1266,14 +1266,14 @@ +@@ -1273,14 +1273,14 @@ * Uncomment this macro to disable the use of CRT in RSA. * */ @@ -117,7 +117,7 @@ /** * \def MBEDTLS_SHA256_SMALLER -@@ -1427,7 +1427,7 @@ +@@ -1434,7 +1434,7 @@ * configuration of this extension). * */ @@ -126,7 +126,7 @@ /** * \def MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO -@@ -1602,7 +1602,7 @@ +@@ -1609,7 +1609,7 @@ * * Comment this macro to disable support for SSL session tickets */ @@ -135,7 +135,7 @@ /** * \def MBEDTLS_SSL_EXPORT_KEYS -@@ -1632,7 +1632,7 @@ +@@ -1639,7 +1639,7 @@ * * Comment this macro to disable support for truncated HMAC in SSL */ @@ -144,7 +144,7 @@ /** * \def MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT -@@ -1691,7 +1691,7 @@ +@@ -1698,7 +1698,7 @@ * * Comment this to disable run-time checking and save ROM space */ @@ -153,7 +153,7 @@ /** * \def MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3 -@@ -2021,7 +2021,7 @@ +@@ -2028,7 +2028,7 @@ * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 */ @@ -162,7 +162,7 @@ /** * \def MBEDTLS_ARIA_C -@@ -2087,7 +2087,7 @@ +@@ -2094,7 +2094,7 @@ * This module enables the AES-CCM ciphersuites, if other requisites are * enabled as well. */ @@ -171,7 +171,7 @@ /** * \def MBEDTLS_CERTS_C -@@ -2099,7 +2099,7 @@ +@@ -2106,7 +2106,7 @@ * * This module is used for testing (ssl_client/server). */ @@ -180,7 +180,7 @@ /** * \def MBEDTLS_CHACHA20_C -@@ -2203,7 +2203,7 @@ +@@ -2214,7 +2214,7 @@ * \warning DES is considered a weak cipher and its use constitutes a * security risk. We recommend considering stronger ciphers instead. */ @@ -189,7 +189,7 @@ /** * \def MBEDTLS_DHM_C -@@ -2366,7 +2366,7 @@ +@@ -2377,7 +2377,7 @@ * This module adds support for the Hashed Message Authentication Code * (HMAC)-based key derivation function (HKDF). */ @@ -198,7 +198,7 @@ /** * \def MBEDTLS_HMAC_DRBG_C -@@ -2676,7 +2676,7 @@ +@@ -2687,7 +2687,7 @@ * * This module enables abstraction of common (libc) functions. */ @@ -207,7 +207,7 @@ /** * \def MBEDTLS_POLY1305_C -@@ -2697,7 +2697,7 @@ +@@ -2708,7 +2708,7 @@ * Caller: library/md.c * */ @@ -216,7 +216,7 @@ /** * \def MBEDTLS_RSA_C -@@ -2804,7 +2804,7 @@ +@@ -2815,7 +2815,7 @@ * * Requires: MBEDTLS_CIPHER_C */ @@ -225,7 +225,7 @@ /** * \def MBEDTLS_SSL_CLI_C -@@ -2904,7 +2904,7 @@ +@@ -2915,7 +2915,7 @@ * * This module provides run-time version information. */ @@ -234,7 +234,7 @@ /** * \def MBEDTLS_X509_USE_C -@@ -3014,7 +3014,7 @@ +@@ -3025,7 +3025,7 @@ * Module: library/xtea.c * Caller: */ -- 2.25.1