All of lore.kernel.org
 help / color / mirror / Atom feed
From: Mathieu Dubois-Briand <mathieu.dubois-briand@hyprua.org>
To: openembedded-devel@lists.openembedded.org
Cc: akuster808@gmail.com, Mathieu Dubois-Briand <mbriand@witekio.com>
Subject: Re: [meta-networking][dunfell][PATCH 1/4] mbedtls: Fix CVE product name
Date: Tue, 4 Oct 2022 08:34:43 +0200	[thread overview]
Message-ID: <YzvUA8zS7tmm+81H@WIPC21110265> (raw)
In-Reply-To: <20221004062843.2541778-1-mbriand@witekio.com>

Hi,

Fixing the CVE product name from mbedtls uncover a lot of CVEs. Some of these
are fixed in the last 2.16 version, but some remain. Here is what I found:

- CVE-2020-36477 and CVE-2022-35409: I added patches in this PR, but they did
  NOT apply cleanly when cherry-picking them. Original commits:
  https://github.com/Mbed-TLS/mbedtls/commit/f3e4bd8632b71dc491e52e6df87dc3e409d2b869
  https://github.com/Mbed-TLS/mbedtls/commit/e5af9fabf7d68e3807b6ea78792794b8352dbba2

- CVE-2021-43666: Patch is merged in 2.16.12 but CPE do not exclude 2.16.12, so
  I added it to whitelist.

- CVE-2021-45450 and CVE-2021-45451: I believed the CPE are completely wrong
  here, as PSA was introduced in mbedtls-2.22.0. I may add it to the whitelist,
  but I believe the CPE has to be modified.

- CVE-2021-24119: Fixed in master and has to be backported, but it's not clear
  which commits exactly fixed the issue. Seems to be be165bd32b87 and some
  parents (from https://github.com/Mbed-TLS/mbedtls/pull/4305).

Best regards,
Mathieu


  parent reply	other threads:[~2022-10-04  6:34 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-10-04  6:28 [meta-networking][dunfell][PATCH 1/4] mbedtls: Fix CVE product name Mathieu Dubois-Briand
2022-10-04  6:28 ` [meta-networking][dunfell][PATCH 2/4] mbedtls: Update to 2.16.12 stable version Mathieu Dubois-Briand
2022-10-04 18:16   ` akuster808
2022-10-05  8:24     ` Mathieu Dubois-Briand
2022-11-02 12:42       ` Mathieu Dubois-Briand
2022-10-04  6:28 ` [meta-networking][dunfell][PATCH 4/4] mbedtls: Whitelist CVE-2021-43666 Mathieu Dubois-Briand
2022-10-04  6:34 ` Mathieu Dubois-Briand [this message]
     [not found] ` <171AC9D81EA1BDC1.13098@lists.openembedded.org>
2022-10-05  8:33   ` [oe] " Mathieu Dubois-Briand

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=YzvUA8zS7tmm+81H@WIPC21110265 \
    --to=mathieu.dubois-briand@hyprua.org \
    --cc=akuster808@gmail.com \
    --cc=mbriand@witekio.com \
    --cc=openembedded-devel@lists.openembedded.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.