Due to a security advisory released on February 1st 2018[1], it's
advisable to update mbedTLS to 2.7.0.
The vulnerability, identified as CVE-2018-0488 and CVE-2018-0487, risk
remote code execution when truncated HMAC is enabled or when verifying
RSASSA-PSS signatures.
[1] https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-01Fixes: #6025
Signed-off-by: Kumar Gala <kumar.gala@linaro.org>
Due to a security advisory released on August 28th 2017[1], it's
advisable to update mbedTLS to 2.6.0.
The vulnerability, identified as CVE-2017-14032, allows bypassing the
authentication of a peer when the authentication mode is configured as
optional (the default is secure, but applications might change the
setting.)
tests/crypto/mbedtls is passing.
[1] https://goo.gl/s4imN6
Signed-off-by: Leandro Pereira <leandro.pereira@intel.com>
Adding the pristine version of mbed TLS to the zephyr source tree
as the initial step of porting the mbed TLS library to Zephyr
Jira: ZEP-327
Jira: ZEP-340
Origin: https://tls.mbed.org/download/start/mbedtls-2.3.0-apache.tgz
Change-Id: Iae814560310ebd00af52c7b1fb9d03195388fa0c
Signed-off-by: Sergio Rodriguez <sergio.sf.rodriguez@intel.com>
Signed-off-by: Kuo-Lang Tseng <kuo-lang.tseng@intel.com>
Kumar Gala