Hello community, here is the log from the commit of package mbedtls for openSUSE:Factory checked in at 2020-09-04 10:51:34 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/mbedtls (Old) and /work/SRC/openSUSE:Factory/.mbedtls.new.3399 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "mbedtls" Fri Sep 4 10:51:34 2020 rev:24 rq:830740 version:2.23.0 Changes: -------- --- /work/SRC/openSUSE:Factory/mbedtls/mbedtls.changes 2020-04-07 10:23:35.137980189 +0200 +++ /work/SRC/openSUSE:Factory/.mbedtls.new.3399/mbedtls.changes 2020-09-04 10:51:49.090388903 +0200 @@ -1,0 +2,14 @@ +Mon Aug 31 10:41:19 UTC 2020 - Martin Pluskal <mplus...@suse.com> + +- Do not run testsuite in parallel - its not reliable + +------------------------------------------------------------------- +Mon Aug 17 07:53:22 UTC 2020 - Dirk Mueller <dmuel...@suse.com> + +- update to 2.23.0: + a lot of changes see https://github.com/ARMmbed/mbedtls/releases/tag/v2.23.0 + * Fix a side channel vulnerability in modular exponentiation that could reveal an RSA private key used in a secure enclave. Noticed by Sangho Lee, Ming-Wei Shih, Prasun Gera, Taesoo Kim and Hyesoon Kim (Georgia Institute of Technology); and Marcus Peinado (Microsoft Research). Reported by Raoul Strackx (Fortanix) in #3394. + * Fix side channel in mbedtls_ecp_check_pub_priv() and mbedtls_pk_parse_key() / mbedtls_pk_parse_keyfile() (when loading a private key that didn't include the uncompressed public key), as well as mbedtls_ecp_mul() / mbedtls_ecp_mul_restartable() when called with a NULL f_rng argument. An attacker with access to precise enough timing and memory access information (typically an untrusted operating system attacking a secure enclave) could fully recover the ECC private key. Found and reported by Alejandro Cabrera Aldaya and Billy Brumley. + * Fix issue in Lucky 13 counter-measure that could make it ineffective when hardware accelerators were used (using one of the MBEDTLS_SHAxxx_ALT macros). This would cause the original Lucky 13 attack to be possible in those configurations, allowing an active network attacker to recover plaintext after repeated timing measurements under some conditions. Reported and fix suggested by Luc Perneel in #3246. + +------------------------------------------------------------------- Old: ---- mbedtls-2.16.5-apache.tgz New: ---- v2.23.0.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ mbedtls.spec ++++++ --- /var/tmp/diff_new_pack.NgbtbD/_old 2020-09-04 10:51:57.478393397 +0200 +++ /var/tmp/diff_new_pack.NgbtbD/_new 2020-09-04 10:51:57.478393397 +0200 @@ -16,17 +16,17 @@ # -%define lib_tls libmbedtls12 -%define lib_crypto libmbedcrypto3 -%define lib_x509 libmbedx509-0 +%define lib_tls libmbedtls13 +%define lib_crypto libmbedcrypto5 +%define lib_x509 libmbedx509-1 Name: mbedtls -Version: 2.16.5 +Version: 2.23.0 Release: 0 Summary: Libraries for crypto and SSL/TLS protocols License: Apache-2.0 Group: Development/Libraries/C and C++ URL: https://tls.mbed.org -Source: https://tls.mbed.org/download/%{name}-%{version}-apache.tgz +Source: https://github.com/ARMmbed/mbedtls/archive/v%{version}.tar.gz Source99: baselibs.conf BuildRequires: cmake BuildRequires: ninja @@ -109,8 +109,10 @@ %cmake_install %check -export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:%{_builddir}/%{name}-%{version}/build/library -%ctest +# parallel execution fails +# %%ctest +pushd build +%{_bindir}/ctest --output-on-failure --force-new-ctest-process -j1 %post -n %{lib_tls} -p /sbin/ldconfig %post -n %{lib_crypto} -p /sbin/ldconfig @@ -123,7 +125,9 @@ %license LICENSE %doc ChangeLog README.md %dir %{_includedir}/mbedtls +%dir %{_includedir}/psa %{_includedir}/mbedtls/*.h +%{_includedir}/psa/*.h %{_libdir}/libmbedtls.so %{_libdir}/libmbedcrypto.so %{_libdir}/libmbedx509.so ++++++ baselibs.conf ++++++ --- /var/tmp/diff_new_pack.NgbtbD/_old 2020-09-04 10:51:57.518393418 +0200 +++ /var/tmp/diff_new_pack.NgbtbD/_new 2020-09-04 10:51:57.518393418 +0200 @@ -1,3 +1,3 @@ -libmbedtls12 -libmbedx509-0 -libmbedcrypto3 +libmbedtls13 +libmbedx509-1 +libmbedcrypto5
