SUSE alert openSUSE-SU-2026:0213-1 (mbedtls-2)

From:
             
 
maintenance@opensuse.org
To:
             
 
security-announce@lists.opensuse.org
Subject:
             
 
openSUSE-SU-2026:0213-1: important: Security update for mbedtls-2
Date:
             
 
Thu, 25 Jun 2026 15:05:25 +0200
Message-ID:
             
 
<20260625130525.5FFC1FCE7@maintenance.suse.de>
Archive-link:
             
 
Article

   openSUSE Security Update: Security update for mbedtls-2
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2026:0213-1
Rating:             important
References:         #1240051 #1240052 
Cross-References:   CVE-2025-27809 CVE-2025-27810
Affected Products:
                    openSUSE Backports SLE-15-SP7
______________________________________________________________________________

   An update that fixes two vulnerabilities is now available.

Description:

   This update for mbedtls-2 fixes the following issues:

   - Update to version 2.28.10 (2.28 LTS line), fixing:
     * CVE-2025-27809: the TLS client accepted certificates valid for
       arbitrary hostnames unless the application called
       mbedtls_ssl_set_hostname() (boo#1240051)
     * CVE-2025-27810: use of uninitialized stack memory when composing the
       TLS Finished message could lead to an authentication bypass such as a
       replay (boo#1240052)
   - Sync packaging with Factory: enable MBEDTLS_SSL_DTLS_SRTP and
     MBEDTLS_SSL_PROTO_DTLS and ship the everest headers and pkg-config files
     in the -devel subpackage


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Backports SLE-15-SP7:

      zypper in -t patch openSUSE-2026-213=1



Package List:

   - openSUSE Backports SLE-15-SP7 (aarch64 i586 ppc64le s390x x86_64):

      libmbedcrypto7-2.28.10-bp157.2.3.1
      libmbedtls14-2.28.10-bp157.2.3.1
      libmbedx509-1-2.28.10-bp157.2.3.1
      mbedtls-2-devel-2.28.10-bp157.2.3.1

   - openSUSE Backports SLE-15-SP7 (aarch64_ilp32):

      libmbedcrypto7-64bit-2.28.10-bp157.2.3.1
      libmbedtls14-64bit-2.28.10-bp157.2.3.1
      libmbedx509-1-64bit-2.28.10-bp157.2.3.1

   - openSUSE Backports SLE-15-SP7 (x86_64):

      libmbedcrypto7-32bit-2.28.10-bp157.2.3.1
      libmbedtls14-32bit-2.28.10-bp157.2.3.1
      libmbedx509-1-32bit-2.28.10-bp157.2.3.1


References:

   https://www.suse.com/security/cve/CVE-2025-27809.html
   https://www.suse.com/security/cve/CVE-2025-27810.html
   https://bugzilla.suse.com/1240051
   https://bugzilla.suse.com/1240052