{"id":"openSUSE-SU-2017:0790-1","summary":"Security update for mbedtls","details":"This update to mbedtls 1.3.19 fixes security issues and bugs.\n\nThe following vulnerability was fixed:\n\nCVE-2017-2784: A remote user could have used a specially crafted certificate to cause\n               mbedtls to free a buffer allocated on the stack when verifying the validity\n               of public key with a secp224k1 curve, which could have allowed remote\n               code execution on some platforms (boo#1029017)\n\nThe following non-security changes are included:\n\n- Add checks to prevent signature forgeries for very large messages while using RSA through\n  the PK module in 64-bit systems.\n- Fixed potential livelock during the parsing of a CRL in PEM format\n","modified":"2026-02-04T02:54:51.773560Z","published":"2017-03-22T10:02:23Z","related":["CVE-2017-2784"],"upstream":["CVE-2017-2784"],"references":[{"type":"ADVISORY","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WRIPVQ2ATMWAEIYYJETVM2L3IO7IWKFA/#WRIPVQ2ATMWAEIYYJETVM2L3IO7IWKFA"},{"type":"REPORT","url":"https://bugzilla.suse.com/1029017"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-2784"}],"affected":[{"package":{"name":"mbedtls","ecosystem":"SUSE:Package Hub 12","purl":"pkg:rpm/suse/mbedtls&distro=SUSE%20Package%20Hub%2012"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.19-5.1"}]}],"ecosystem_specific":{"binaries":[{"mbedtls-devel":"1.3.19-5.1","libmbedtls9":"1.3.19-5.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2017:0790-1.json"}}],"schema_version":"1.7.3"}