Your message dated Sat, 05 Sep 2026 17:32:07 +0000
with message-id <[email protected]>
and subject line Bug#1133841: fixed in mbedtls 3.6.6-0.1~deb13u1
has caused the Debian Bug report #1133841,
regarding mbedtls: CVE-2026-25833 CVE-2026-25834 CVE-2026-25835
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1133841: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133841
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: mbedtls
Version: 3.6.5-0.1
Severity: grave
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerabilities were published for mbedtls.
CVE-2026-25833[0]:
| Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer
| overflow in the x509_inet_pton_ipv6() function
CVE-2026-25834[1]:
| Mbed TLS v3.3.0 up to 3.6.5 and 4.0.0 allows Algorithm Downgrade.
CVE-2026-25835[2]:
| Mbed TLS before 3.6.6 and TF-PSA-Crypto before 1.1.0 misuse seeds in
| a Pseudo-Random Number Generator (PRNG).
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-25833
https://www.cve.org/CVERecord?id=CVE-2026-25833
[1] https://security-tracker.debian.org/tracker/CVE-2026-25834
https://www.cve.org/CVERecord?id=CVE-2026-25834
[2] https://security-tracker.debian.org/tracker/CVE-2026-25835
https://www.cve.org/CVERecord?id=CVE-2026-25835
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: mbedtls
Source-Version: 3.6.6-0.1~deb13u1
Done: Adrian Bunk <[email protected]>
We believe that the bug you reported is fixed in the latest version of
mbedtls, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Adrian Bunk <[email protected]> (supplier of updated mbedtls package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 21 May 2026 13:49:04 +0300
Source: mbedtls
Architecture: source
Version: 3.6.6-0.1~deb13u1
Distribution: trixie
Urgency: medium
Maintainer: Debian IoT Maintainers
<[email protected]>
Changed-By: Adrian Bunk <[email protected]>
Closes: 1132577 1133841
Changes:
mbedtls (3.6.6-0.1~deb13u1) trixie; urgency=medium
.
* Non-maintainer upload.
* Rebuild for trixie.
.
mbedtls (3.6.6-0.1) unstable; urgency=medium
.
* Non-maintainer upload.
* New upstream release.
- CVE-2026-25834: Signature Algorithm Injection
- CVE-2026-25835: PSA random generator cloning
- CVE-2026-34872: FFDH: improper input validation
- CVE-2026-34873: Client impersonation resuming a TLS 1.3 session
- CVE-2026-34874: Null pointer dereference setting a distinguished name
- CVE-2026-34875: Buffer overflow in FFDH public key export
- CVE-2026-34876: CCM multipart finish tag-length validation bypass
(Closes: #1133841, #1132577)
Checksums-Sha1:
ea4cf9fc3e2c34b5349b65bc35e7ef1829b2a25c 2490 mbedtls_3.6.6-0.1~deb13u1.dsc
71dd91cc76e77a0dcf0d8020377523ed7e703d8e 5508045 mbedtls_3.6.6.orig.tar.bz2
e16fc47218071d472de8da50ca9ce99fe720074a 19084
mbedtls_3.6.6-0.1~deb13u1.debian.tar.xz
Checksums-Sha256:
eb9ed1adbbddcb0d00276fac6fcee0056c64ce01481c2522a16dca75792eb5eb 2490
mbedtls_3.6.6-0.1~deb13u1.dsc
8fb65fae8dcae5840f793c0a334860a411f884cc537ea290ce1c52bb64ca007a 5508045
mbedtls_3.6.6.orig.tar.bz2
210466c522eeebc85cf2f76bd5aef935b4ebac465559cc0a84f9e73a8ed6601c 19084
mbedtls_3.6.6-0.1~deb13u1.debian.tar.xz
Files:
4ac6965e436730429c88b4ef55b8e570 2490 libs optional
mbedtls_3.6.6-0.1~deb13u1.dsc
8147a63a1ce289ebc0fb2190a5cce03f 5508045 libs optional
mbedtls_3.6.6.orig.tar.bz2
3bd56eb944e5cd4bb5141d91cae6c939 19084 libs optional
mbedtls_3.6.6-0.1~deb13u1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEOvp1f6xuoR0v9F3wiNJCh6LYmLEFAmpJJv8ACgkQiNJCh6LY
mLGGmA//Y+kg8ukA5VdDkVJeVpFUeDJezjeMejfDTthZTEtsPrS9gngLeo6XN6Td
q5OIITjyHa4NmQP4wAVk3FEPwNvnpuR2ERkYGuenRejRKss+xUoBTOzKLEgyB8tm
Vhx5fH6RBfb68mUb87asBVIfL2bzviOoE/RoGw4n4SyzTAS2QSyKqRZ5WiurQDTz
Tu6QqFSksb3GmphJjrrX/6v3URT5hf9bQr679knckJI+p1NDHz+qqbJU3cIy9lSZ
ftk/wsSZfBRC1nDySjNs3pdR5qxnvtc7b1UjYbAQSg6E1l4RwqAhhTh2P1j+ubSm
gq5nEv09LLfcq+kRebxsN2vUPV7iJLBLH+DtY04C1sPVI1UNA2qZTaOOXtZRoUqX
FMV/VXL2PYmQUDWx+7iOTKG/8D2ra86A0zFS/W/HW0TZFQ/4FZ5LFxYz+nw6UGJH
7LxmNWxecbE0TLsp3KbcuPGYBV95oquUTTjEIl5WwCMF8GJgJUKeJuWh18ZLR2lc
vYIjCllZ+O972ffwN+3TUZzwmiYyWm03/AA5QH+jwEnjXHVkNUANAJoHnVk4RLZz
H/Upm3viaCnfFLRLphXFY5I8/KC93/748MPIeS3lb+8LaeNuQUaUfgM9E7z5DkQk
gRcwhPWaFlt3SaWN7NiIpdI8sQ+2tqpC4SFj8GdXptF/GTbF0bo=
=Btq1
-----END PGP SIGNATURE-----
pgpUc7vRDdsE_.pgp
Description: PGP signature
--- End Message ---
