SSLClient - generic secure client Arduino library using mbedtls - govorox/SSLClient

SSLClient - generic secure client Arduino library using mbedtls - govorox/SSLClient

> **Important — OpenSSL builds are NOT vulnerable.** This defect is in GoAhead's mbedtls TLS backend (`src/mbedtls.c`). Builds linked against **OpenSSL** — the project's preferred and default TLS b...

> **Important — OpenSSL builds are NOT vulnerable.** This defect is in GoAhead's mbedtls TLS backend (`src/mbedtls.c`). Builds linked against **OpenSSL** — the project's preferred and default TLS b...

TL;DR FoxIO has published full details and proof-of-concept code for three GoAhead TLS vulnerabilities. The worst scores 9.1 on CVSS and lets revoked client certificates pass mutual TLS checks. GoAhead is an embedded web server that, according to FoxIO, runs in "hundreds of millions" of devices. Three separate bugs in GoAhead's TLS backends can accept revoked certificates, expose encrypted sessions or skip a chain-depth limit.

TL;DR FoxIO has published full details and proof-of-concept code for three GoAhead TLS vulnerabilities. The worst scores 9.1 on CVSS and lets revoked client certificates pass mutual TLS checks. GoAhead is an embedded web server that, according to FoxIO, runs in "hundreds of millions" of devices. Three separate bugs in GoAhead's TLS backends can accept revoked certificates, expose encrypted sessions or skip a chain-depth limit.

Last month we announced wolfSSL as a TLS provider for Zephyr's secure sockets layer. That work covered the networking side of the stack. Today we are

Hm. ESP, lwIP und mbedTLS sind schon cool.

OpenVPN 2.7.6 is now available with security fixes affecting Windows and mbedTLS, alongside additional bug fixes and stability improvements. The post OpenVPN 2.7.6 Released with Security Fixes for Windows and mbedTLS appeared first on Linux Today.

wolfSSL’s new tinytls13 profile against a parity-matched MbedTLS, measured on Cortex-M33, x86_64, and aarch64. wolfSSL and MbedTLS both target small embedded TLS, but configured and built with parity options they are not the same size. The new tinytls13 profile is a TLS 1.3-only build that strips everything which is not TLS 1.3 and defaults to […]

wolfSSL’s new tinytls13 profile against a parity-matched MbedTLS, measured on Cortex-M33, x86_64, and aarch64. wolfSSL and MbedTLS both target small embedded TLS, but configured and built with parity options they are not the same size. The new tinytls13 profile is a TLS 1.3-only build that strips everything which is not TLS 1.3 and defaults to […]

Security updates have been issued by **AlmaLinux** (buildah, freerdp, gegl04, go-fdo-client, grafana, grafana-pcp, kernel, and pipewire), **Debian** (aom, chromium, libde265, libssh2, thunderbird, and tryton-server), **Fedora** (chromium, composer, cosmic-greeter, gegl04, greetd, ibus-table, jss, libheif, lightdm, lxdm, memcached, perl-DBD-Pg, plasma-login-manager, rust-webbrowser, sddm, selinux-policy, slitherer, and tkimg), **Mageia** (expat, mingw-expat, mbedtls, microcode, python-linkify-it-py, and tomcat), **Oracle** (buildah, container-tools:ol8, dbus-broker, freerdp, go-toolset:ol8, grafana-pcp, kernel, kernel-uek, nodejs24, php, and pipewire), **Slackware** (libpcap, libxml2, mozilla-firefox, mozilla-thunderbird, and util-linux), **SUSE** (bson-devel, busybox, bzip2, c-ares, cpio, cups-filters, dracut, ffmpeg-7, ffmpeg-8, file-roller, firefox, firefox-esr, glances-common, grafana, hauler, helm, helm3, java-17-openjdk, java-21-openjdk, lcms2, libcupsfilters, libheif, libmsgpack-c2, libsoup, libsoup2, libusb-1_0, libvirt, LibVNCServer, mcphost, ollama, opencode, openssl-1_1, openssl-3, php-composer2, podman, postgresql15, postgresql17, postgresql18, python, python-aiohttp, python-h2, python-sqlparse, python310, rpcbind, sssd, thunderbird, trivy, ucode-intel, and webkit2gtk3), and **Ubuntu** (linux, linux-aws, linux-aws-7.0, linux-gcp, linux-gke, linux-hwe-7.0, linux-realtime, linux, linux-aws, linux-fips, linux-kvm, linux-lts-xenial, linux, linux-fips, linux-gcp, linux-gcp-fips, linux-gke, linux-gkeop, linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency, linux-raspi, linux-realtime, linux-realtime-6.8, linux, linux-gcp, linux-gcp-fips, linux-gke, linux-gkeop, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-intel-iot-realtime, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-realtime, linux-aws-5.4, linux-gcp, linux-gcp-5.4, linux-gcp-7.0, linux-oem-7.0, minetest, and miniupnpd).

Dart FFI bindings to the open62541 OPC UA stack. Provides client and server APIs for OPC UA over TCP, with subscriptions, custom types and mbedTLS encryption. Changelog excerpt: - `ClientIsolate.keepConnected`/ `stopKeepConnected`/ `reconnectStream`: the auto-reconnect supervisor introduced for `Client`in 1.5.7 is now available on the isolate client too, by delegating to the native client's supervisor inside the isolate. This matters because the isolate client is where a dead session is the most invisible: the caller-side `runIterate()`future only completes when native run_iterate returns non-GOOD, so a session that dies while iterate keeps reporting GOOD (seen in produ[...]