kumquat-buildroot/package/mbedtls/mbedtls.hash

# Locally calculated
sha256  4786b7d1676f5e4d248f3a7f2d28446876d64962634f060ff21b92c690cfbe86  mbedtls-2.16.7.tar.gz
sha256  cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30  apache-2.0.txt
mbedtls: security bump to version 2.6.0 Fixes CVE-2017-14032: authentication bypass. https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-02 Add license hash. Cc: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Peter Korsgaard <peter@korsgaard.com> 2017-09-05 21:05:26 +02:00			`# Locally calculated`
package/mbedtls: security bump to version 2.16.7 - Fix a side channel vulnerability in modular exponentiation that could reveal an RSA private key used in a secure enclave. - Fix side channel in mbedtls_ecp_check_pub_priv() and mbedtls_pk_parse_key() / mbedtls_pk_parse_keyfile() (when loading a private key that didn't include the uncompressed public key), as well as mbedtls_ecp_mul() / mbedtls_ecp_mul_restartable() when called with a NULL f_rng argument. An attacker with access to precise enough timing and memory access information (typically an untrusted operating system attacking a secure enclave) could fully recover the ECC private key. - Fix issue in Lucky 13 counter-measure that could make it ineffective when hardware accelerators were used (using one of the MBEDTLS_SHAxxx_ALT macros). This would cause the original Lucky 13 attack to be possible in those configurations, allowing an active network attacker to recover plaintext after repeated timing measurements under some conditions. https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-07 Switch to github to get latest release Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> 2020-07-13 12:12:42 +02:00			`sha256 4786b7d1676f5e4d248f3a7f2d28446876d64962634f060ff21b92c690cfbe86 mbedtls-2.16.7.tar.gz`
package/mbedtls: security bump to version 2.16.5 - Fix potential memory overread when performing an ECDSA signature operation. The overread only happens with cryptographically low probability (of the order of 2^-n where n is the bitsize of the curve) unless the RNG is broken, and could result in information disclosure or denial of service (application crash or extra resource consumption). - To avoid a side channel vulnerability when parsing an RSA private key, read all the CRT parameters from the DER structure rather than reconstructing them. - Update indentation of hash file (two spaces) Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr> 2020-02-21 22:56:46 +01:00			`sha256 cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30 apache-2.0.txt`