[Buildroot] [PATCH] package/mbedtls: security bump to version 2.8.10

[Arnout Vandecappelle]

On 26/03/2025 21:16, Peter Korsgaard wrote:
> Fixes the following security issues:
>
> - CVE-2025-27809: Note that TLS clients should generally call
>    mbedtls_ssl_set_hostname() if they use certificate authentication (i.e.
>    not pre-shared keys).  Otherwise, in many scenarios, the server could be
>    impersonated.  The library will now prevent the handshake and return
>    MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME if
>    mbedtls_ssl_set_hostname() has not been called.
>
>    https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-03-1/
>
> - CVE-2025-27810: Zeroize temporary heap buffers used in PSA operations.
>    Fix a vulnerability in the TLS 1.2 handshake.  If memory allocation
>    failed or there was a cryptographic hardware failure when calculating the
>    Finished message, it could be calculated incorrectly.  This would break
>    the security guarantees of the TLS handshake.
>
>    https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-03-2/
>
> For more details, see the release notes:
> https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-2.28.10
>
> Signed-off-by: Peter Korsgaard <peter at korsgaard.com>

  Applied to 2025.02.x, 2024.11.x and 2024.02.x, thanks.

  Regards,
  Arnout

> ---
>   package/mbedtls/mbedtls.hash | 4 ++--
>   package/mbedtls/mbedtls.mk   | 2 +-
>   2 files changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/package/mbedtls/mbedtls.hash b/package/mbedtls/mbedtls.hash
> index 9de7f731da..6fc68ddac6 100644
> --- a/package/mbedtls/mbedtls.hash
> +++ b/package/mbedtls/mbedtls.hash
> @@ -1,4 +1,4 @@
> -# From https://github.com/ARMmbed/mbedtls/releases/tag/v2.28.9:
> -sha256  e85ea97aaf78dd6c0a5ba2e54dd5932ffa15f39abfc189c26beef7684630c02b  mbedtls-2.28.9.tar.bz2
> +# From https://github.com/ARMmbed/mbedtls/releases/tag/v2.28.10:
> +sha256  19e5b81fdac0fe22009b9e2bdcd52d7dcafbf62bc67fc59cf0a76b5b5540d149  mbedtls-2.28.10.tar.bz2
>   # Locally calculated
>   sha256  9b405ef4c89342f5eae1dd828882f931747f71001cfba7d114801039b52ad09b  LICENSE
> diff --git a/package/mbedtls/mbedtls.mk b/package/mbedtls/mbedtls.mk
> index 2faa6dff55..fd6682fbfd 100644
> --- a/package/mbedtls/mbedtls.mk
> +++ b/package/mbedtls/mbedtls.mk
> @@ -4,7 +4,7 @@
>   #
>   ################################################################################
>   
> -MBEDTLS_VERSION = 2.28.9
> +MBEDTLS_VERSION = 2.28.10
>   MBEDTLS_SITE = https://github.com/Mbed-TLS/mbedtls/releases/download/mbedtls-$(MBEDTLS_VERSION)
>   MBEDTLS_SOURCE = mbedtls-$(MBEDTLS_VERSION).tar.bz2
>   MBEDTLS_CONF_OPTS = \