SUSE alert openSUSE-SU-2026:21144-1 (mbedtls)

From:
             
 
null@suse.de
To:
             
 
security-announce@lists.opensuse.org
Subject:
             
 
openSUSE-SU-2026:21144-1: critical: Security update for mbedtls
Date:
             
 
Tue, 30 Jun 2026 09:48:36 +0200
Message-ID:
             
 
<20260630074836.00903FF48@maintenance.suse.de>
Archive-link:
             
 
Article
openSUSE security update: security update for mbedtls
-------------------------------------------------------------

Announcement ID: openSUSE-SU-2026:21144-1
Rating: critical
References:

  * bsc#1231708
  * bsc#1240051
  * bsc#1240052
  * bsc#1245808
  * bsc#1245809
  * bsc#1245810
  * bsc#1245811
  * bsc#1246783
  * bsc#1246784
  * bsc#1246973
  * bsc#1252341
  * bsc#1252454



Cross-References:

  * CVE-2024-49195
  * CVE-2025-27809
  * CVE-2025-27810
  * CVE-2025-47917
  * CVE-2025-48965
  * CVE-2025-49087
  * CVE-2025-49600
  * CVE-2025-49601
  * CVE-2025-52496
  * CVE-2025-52497
  * CVE-2025-54764
  * CVE-2025-59438
  * CVE-2026-25833
  * CVE-2026-25834
  * CVE-2026-25835



CVSS scores:

  * CVE-2024-49195 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2024-49195 ( SUSE ): 9.2 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  * CVE-2025-59438 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
  * CVE-2025-59438 ( SUSE ): 5.7 CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
  * CVE-2026-25833 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-25833 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-25834 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
  * CVE-2026-25834 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
  * CVE-2026-25835 ( SUSE ): 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
  * CVE-2026-25835 ( SUSE ): 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Affected Products:

         openSUSE Leap 16.0

-------------------------------------------------------------

An update that solves 15 vulnerabilities and has 12 bug fixes can now be installed.

Description:

This update for mbedtls fixes the following issues:

Changes in mbedtls:

- Update to 3.6.6 (LTS maintenance update from 3.6.1); security fixes
  accumulated across the 3.6.2-3.6.6 releases:
  * CVE-2024-49195 (boo#1231708): buffer underrun in pkwrite when
    writing an opaque key pair
  * CVE-2025-27809 (boo#1240051): certificate verification accepted
    arbitrary hostnames
  * CVE-2025-27810 (boo#1240052): possible authentication bypass on
    failed memory allocation / hardware errors
  * CVE-2025-47917 (boo#1246783): misleading memory management in
    mbedtls_x509_string_to_names()
  * CVE-2025-48965 (boo#1246784): NULL pointer dereference after
    mbedtls_asn1_store_named_data()
  * CVE-2025-49087 (boo#1246973): timing side channel in PKCS#7
    padding removal
  * CVE-2025-49600 (boo#1245808): unchecked return values in LMS
    verification allow signature bypass via fault injection
  * CVE-2025-49601 (boo#1245809): out-of-bounds read in
    mbedtls_lms_import_public_key()
  * CVE-2025-52496 (boo#1245810): race in AES-NI support detection can
    lead to AES key extraction or GCM forgery
  * CVE-2025-52497 (boo#1245811): one-byte heap underflow when parsing
    PEM-encrypted material
  * CVE-2025-54764 (boo#1252341): timing attacks in RSA operations
  * CVE-2025-59438 (boo#1252454): padding-oracle attack via timing of
    cipher error reporting
  * CVE-2026-25833: PSA RNG state duplicated across fork()
  * CVE-2026-25834: TLS 1.3 HelloRetryRequest man-in-the-middle
    session-resumption downgrade
  * CVE-2026-25835: RNG state duplicated when application/VM state is
    cloned


Patch instructions:

   To install this openSUSE security update use the suse recommended installation methods
   like YaST online_update or "zypper patch".
   Alternatively you can run the command listed for your product:

- openSUSE Leap 16.0

   zypper in -t patch openSUSE-Leap-16.0-packagehub-339=1

Package List:

- openSUSE Leap 16.0:

  libeverest-3.6.6-bp160.1.1
  libeverest-x86-64-v3-3.6.6-bp160.1.1
  libmbedcrypto16-3.6.6-bp160.1.1
  libmbedcrypto16-x86-64-v3-3.6.6-bp160.1.1
  libmbedtls21-3.6.6-bp160.1.1
  libmbedtls21-x86-64-v3-3.6.6-bp160.1.1
  libmbedx509-7-3.6.6-bp160.1.1
  libmbedx509-7-x86-64-v3-3.6.6-bp160.1.1
  libp256m-3.6.6-bp160.1.1
  libp256m-x86-64-v3-3.6.6-bp160.1.1
  mbedtls-devel-3.6.6-bp160.1.1

References:

  * https://www.suse.com/security/cve/CVE-2024-49195.html
  * https://www.suse.com/security/cve/CVE-2025-27809.html
  * https://www.suse.com/security/cve/CVE-2025-27810.html
  * https://www.suse.com/security/cve/CVE-2025-47917.html
  * https://www.suse.com/security/cve/CVE-2025-48965.html
  * https://www.suse.com/security/cve/CVE-2025-49087.html
  * https://www.suse.com/security/cve/CVE-2025-49600.html
  * https://www.suse.com/security/cve/CVE-2025-49601.html
  * https://www.suse.com/security/cve/CVE-2025-52496.html
  * https://www.suse.com/security/cve/CVE-2025-52497.html
  * https://www.suse.com/security/cve/CVE-2025-54764.html
  * https://www.suse.com/security/cve/CVE-2025-59438.html
  * https://www.suse.com/security/cve/CVE-2026-25833.html
  * https://www.suse.com/security/cve/CVE-2026-25834.html
  * https://www.suse.com/security/cve/CVE-2026-25835.html