BSD PortsVulnerable: version 3.6.3 is affected by 11 known vulnerabilities. See below.
wip/mbedtls3 3.6.3 NetBSD
Lightweight, modular cryptographic and SSL/TLS library (3.x branch)
- System
- NetBSD
- Repository
- pkgsrc-wip
- Maintainer
- [email protected]
- Port added
- Last update
- Commit
d1d5df31af- License
- apache-2.0 OR gnu-gpl-v2
- Categories
- wip, security
Description
mbed TLS (formerly known as PolarSSL) makes it trivially easy for developers to include cryptographic and SSL/TLS capabilities in their (embedded) products, facilitating this functionality with a minimal coding footprint.
This contains major version 3 of the library, which is not backwards compatible to version 2.
In the other systems
| System | Port | Version |
|---|---|---|
| NetBSD | wip/mbedtls3 | 3.6.3 |
| OpenBSD | security/mbedtls | 3.6.7 |
| MidnightBSD | security/mbedtls | 2.28.6_1 |
Install
From pkgsrc-wip (no binary package):
cd /usr/pkgsrc/wip/mbedtls3 && make install cleanDependencies
Required by 2
Known vulnerabilities 11
- mbedtls: verification-bypass (CVE-2018-1000520)
- mbedtls: denial-of-service (CVE-2021-43666)
- mbedtls: use-after-free (CVE-2025-47917)
- mbedtls: null-pointer-dereference (CVE-2025-48965)
- mbedtls: side-channel (CVE-2025-49087)
- mbedtls: signature-forgery (CVE-2025-49600)
- mbedtls: out-of-bounds-read (CVE-2025-49601)
- mbedtls: sensitive-information-disclosure (CVE-2025-52496)
- mbedtls: denial-of-service (CVE-2025-52497)
- mbedtls: side-channel (CVE-2025-54764)
- mbedtls: padding-oracle-attack (CVE-2025-59438)