BSD PortsVulnerable: version 2.28.8 is affected by 12 known vulnerabilities. See below.
security/mbedtls 2.28.8 NetBSD
Lightweight, modular cryptographic and SSL/TLS library (2.x branch)
- System
- NetBSD
- Repository
- pkgsrc
- Maintainer
- [email protected]
- License
- apache-2.0 OR gnu-gpl-v2
- Categories
- security
- Package size
- 849.9 KiB, 6597.1 KiB installed
Description
mbed TLS (formerly known as PolarSSL) makes it trivially easy for developers to include cryptographic and SSL/TLS capabilities in their (embedded) products, facilitating this functionality with a minimal coding footprint.
This package contains the old stable major 2 version of the library.
In the other systems
| System | Port | Version |
|---|---|---|
| NetBSD | security/mbedtls | 2.28.8 |
| OpenBSD | security/mbedtls | 3.6.7 |
| MidnightBSD | security/mbedtls | 2.28.6_1 |
Install
Binary package:
pkgin install mbedtlsFrom pkgsrc:
cd /usr/pkgsrc/security/mbedtls && make install cleanPackages
The version each package repository carries. “-” means the repository builds no package of it, “n/a” that there is no such repository.
| Repository | Version |
|---|---|
| NetBSD 10.1 x86_64 | 2.28.8 |
| NetBSD 10.1 aarch64 | 2.28.8 |
| SmartOS / illumos x86_64 | 2.28.8 |
| macOS 15 arm64 | 2.28.8 |
Dependencies
Known vulnerabilities 12
- mbedtls: verification-bypass (CVE-2018-1000520)
- mbedtls: arbitrary-memory-access (CVE-2021-36647)
- mbedtls: denial-of-service (CVE-2021-43666)
- mbedtls: sensitive-information-disclosure (CVE-2021-45451)
- mbedtls: use-after-free (CVE-2025-47917)
- mbedtls: null-pointer-dereference (CVE-2025-48965)
- mbedtls: signature-forgery (CVE-2025-49600)
- mbedtls: out-of-bounds-read (CVE-2025-49601)
- mbedtls: sensitive-information-disclosure (CVE-2025-52496)
- mbedtls: denial-of-service (CVE-2025-52497)
- mbedtls: side-channel (CVE-2025-54764)
- mbedtls: padding-oracle-attack (CVE-2025-59438)