Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

mbedtls: Update to upstream 3.6.2 #99997

Merged
merged 1 commit into from
Dec 11, 2024
Merged

Conversation

akien-mga
Copy link
Member

@akien-mga akien-mga commented Dec 4, 2024

Security fix: https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-3.6.2

For 4.2 and earlier, we should look if there's an update to mbedtls 2.28.x LTS.

Edit: This specific security issue doesn't seem to affect 2.28.x:

The vulnerability is present in Mbed TLS 3.5.x, Mbed TLS 3.6.0 and Mbed TLS 3.6.1. Earlier versions had a different implementation of the problematic cases and are not affected.

But there is a 2.28.9 we missed in August that we should update 4.2 and earlier branches to.

@akien-mga akien-mga added bug topic:thirdparty cherrypick:4.3 Considered for cherry-picking into a future 4.3.x release labels Dec 4, 2024
@akien-mga akien-mga added this to the 4.4 milestone Dec 4, 2024
@akien-mga akien-mga requested a review from a team as a code owner December 4, 2024 01:22
Copy link
Collaborator

@Faless Faless left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@Repiteo Repiteo merged commit 84da7c9 into godotengine:master Dec 11, 2024
20 checks passed
@Repiteo
Copy link
Contributor

Repiteo commented Dec 11, 2024

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug cherrypick:4.3 Considered for cherry-picking into a future 4.3.x release topic:thirdparty
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants