Description
Since upstream will release 2.28.10
soon, we need to also update and publish new release of mbedtls-sys-auto
.
From mbedtls email:
Dear Mbed TLS users,
The next release of Mbed TLS (3.6.3 and 2.28.10) is scheduled on Monday
2025-03-24. It will include a security fix for a vulnerability with a
high impact to affected applications.Due to the nature of the vulnerability, which involves an insecure
default in current versions of Mbed TLS, fixing it may require a small
change in application code. We will provide instructions in the release
notes. Without this change, affected applications will fail at runtime
with Mbed TLS 3.6.3 or 2.28.10. Applications that are currently secure
will generally not require any change.We apologize for the inconvenience.
Best regards,
Upstream tracking issue: Mbed-TLS/mbedtls#9886
Note
Because we no longer keep use same version with upstream, please don‘t mix up the current 2.28.10
version of mbedtls-sys-auto
with upstream version.
Current mbedtls-sys-auto
is at 2.28.9
version of upstream mbedtls:
rust-mbedtls/mbedtls-sys/Cargo.toml
Lines 16 to 19 in 9758a23