Skip to content

[PROD-10079] Update and publish new release of mbedtls-sys-auto with new upstream version 2.28.10 #383

Open
@Taowyoo

Description

@Taowyoo

Since upstream will release 2.28.10 soon, we need to also update and publish new release of mbedtls-sys-auto.

From mbedtls email:

Dear Mbed TLS users,

The next release of Mbed TLS (3.6.3 and 2.28.10) is scheduled on Monday
2025-03-24. It will include a security fix for a vulnerability with a
high impact to affected applications.

Due to the nature of the vulnerability, which involves an insecure
default in current versions of Mbed TLS, fixing it may require a small
change in application code. We will provide instructions in the release
notes. Without this change, affected applications will fail at runtime
with Mbed TLS 3.6.3 or 2.28.10. Applications that are currently secure
will generally not require any change.

We apologize for the inconvenience.

Best regards,

Upstream tracking issue: Mbed-TLS/mbedtls#9886

Note
Because we no longer keep use same version with upstream, please don‘t mix up the current 2.28.10 version of mbedtls-sys-auto with upstream version.
Current mbedtls-sys-auto is at 2.28.9 version of upstream mbedtls:

[package.metadata.mbedtls]
git = "https://github.com/Mbed-TLS/mbedtls.git"
version = "2.28.9"
rev = "5e146adef63b326b04282252639bebc2730939c6"

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions