Mbed TLS 3.6.4 Released

List overview All Threads
Download

newer

older

psa crypto driver for imx-smw

Credential validation BEFORE first...

Minos Galanakis

30 Jun 2025 30 Jun '25

10:29 p.m.

Hi Mbed TLS users,

We have released Mbed TLS versions 3.6.4.

These releases of Mbed TLS address several security issues, provide bug fixes, and bring other minor changes. Full details are available in the release notes (https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-3.6.4).

We recommend all users to consider whether they are impacted, and to upgrade appropriately.

Attachments:

attachment.html (text/html — 2.2 KB)

Show replies by date

Gilles Peskine

31 Jul 31 Jul

10:46 a.m.

Hello,

We have updated the mbedtls-3.6.4.tar.bz2 archive in the 3.6.4 release. This is not a change to the release content: the new archive has exactly the same file contents. The new tarball has updated file timestamps which fixes a build failure in environments without Python and some Python packages (https://github.com/Mbed-TLS/mbedtls/issues/10332).

If you are managing a distribution system that records archive checksums, please update from

ec35b18a6c593cf98c3e30db8b98ff93e8940a8c4e690e66b41dfc011d678110 mbedtls-3.6.4.tar.bz2

6a7ed66b4aca38836f0eff8d8fba72992bf0c7326337608ef01de469fd8368bd mbedtls-3.6.4.tar.bz2

The git tag is unaffected. (Building from git does require some Python packages as described in README.md.)

Best regards,

-- Gilles Peskine On behalf of the Mbed TLS development team On 30/06/2025 23:29, Minos Galanakis via mbed-tls wrote: > Hi Mbed TLS users, > > We have released Mbed TLS versions 3.6.4. > > These releases of Mbed TLS address several security issues, provide > bug fixes, and bring other minor changes. Full details are available > in the release notes > (https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-3.6.4). > > We recommend all users to consider whether they are impacted, and to > upgrade appropriately. > >

Gilles Peskine

1 Aug 1 Aug

12:42 p.m.

Apologies for the confusion: the new archive from yesterday was fine, but was accidentally compressed with xz despite its filename having the extension .bz2.

We have now reverted the original archive under the original name mbedtls-3.6.4.tar.bz2, and provided the new archives fixing https://github.com/Mbed-TLS/mbedtls/issues/10332 with a new name mbedtls-3.6.4-easy-make-lib.tar.bz2.

For avoidance of doubt, we're keeping the xz formatted archive available, with a name matching its format.

All three archive have the same file contents:

40d83e4040c3e548a61f6ac19b697b0380149abafd6923196a70b6067b543261 mbedtls-3.6.4-easy-make-lib.tar.bz2 6a7ed66b4aca38836f0eff8d8fba72992bf0c7326337608ef01de469fd8368bd mbedtls-3.6.4-easy-make-lib.tar.xz ec35b18a6c593cf98c3e30db8b98ff93e8940a8c4e690e66b41dfc011d678110 mbedtls-3.6.4.tar.bz2

Use one of the easy-make-lib files if you are affected by https://github.com/Mbed-TLS/mbedtls/issues/10332. Use any of the files, or the Git tag, otherwise.

Best regards,

-- Gilles Peskine On behalf of the Mbed TLS development team On 31/07/2025 11:46, Gilles Peskine via mbed-tls wrote: > Hello, > > We have updated the mbedtls-3.6.4.tar.bz2 archive in the 3.6.4 > release. This is not a change to the release content: the new archive > has exactly the same file contents. The new tarball has updated file > timestamps which fixes a build failure in environments without Python > and some Python packages > (https://github.com/Mbed-TLS/mbedtls/issues/10332). > > If you are managing a distribution system that records archive > checksums, please update from > ec35b18a6c593cf98c3e30db8b98ff93e8940a8c4e690e66b41dfc011d678110 mbedtls-3.6.4.tar.bz2 > to > 6a7ed66b4aca38836f0eff8d8fba72992bf0c7326337608ef01de469fd8368bd mbedtls-3.6.4.tar.bz2 > > The git tag is unaffected. (Building from git does require some Python > packages as described in README.md.) > > Best regards, > > -- > Gilles Peskine > On behalf of the Mbed TLS development team > > On 30/06/2025 23:29, Minos Galanakis via mbed-tls wrote: >> Hi Mbed TLS users, >> >> We have released Mbed TLS versions 3.6.4. >> >> These releases of Mbed TLS address several security issues, provide >> bug fixes, and bring other minor changes. Full details are available >> in the release notes >> (https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-3.6.4). >> >> We recommend all users to consider whether they are impacted, and to >> upgrade appropriately. >> >> > >

381

days inactive

413

days old

mbed-tls@lists.trustedfirmware.org

2 comments

participants

tags (0)

participants (2)

Gilles Peskine
Minos Galanakis