FEDORA-2026-d619d8d077 — security update for micropython

stable

micropython-1.28.0-1.fc45

FEDORA-2026-d619d8d077 created by cstratak 4 months ago for Fedora 45

Automatic update for micropython-1.28.0-1.fc45.

Changelog

* Mon Apr  6 2026 Lumír Balhar <lbalhar@redhat.com> - 1.28.0-1
- Update to 1.28.0
- Security fix for CVE-2026-1998
- Update mbedtls submodule to 3.6.6
- mbedtls security fixes for CVE-2026-25834, CVE-2026-34871, CVE-2026-25833
- CVE-2025-52496, CVE-2025-52497, CVE-2025-49087, CVE-2025-54764, CVE-2025-59438
 Resolves: rhbz#2455368, rhbz#2376688, rhbz#2376701, rhbz#2382261, rhbz#2405245,
 rhbz#2405374, rhbz#2437327, rhbz#2454032, rhbz#2454086, rhbz#2454213

This update was automatically created

4 months ago

This update's test gating status has been changed to 'ignored'.

4 months ago

This update has been submitted for stable by bodhi

4 months ago

Please log in to add feedback.

Metadata

Type

security

Karma

Signed

Content Type

RPM

Test Gating

ignored

Autopush Settings

Unstable by Karma

-3

Stable by Karma

disabled

Stable by Time

0 days

Dates

submitted

4 months ago

in testing

4 months ago

in stable

4 months ago

approved

4 months ago

Builds

micropython-1.28.0-1.fc45

BZ#2376688 CVE-2025-52496 micropython: Mbed TLS AESNI Race Condition Vulnerability [fedora-all]

BZ#2376701 CVE-2025-52497 micropython: Mbed TLS PEM Parsing Buffer Underflow [fedora-all]

BZ#2382261 CVE-2025-49087 micropython: Mbed TLS PKCS#7 Timing Vulnerability [fedora-all]

BZ#2405245 CVE-2025-54764 micropython: Mbedtls timing attacks in RSA operations [fedora-all]

BZ#2405374 CVE-2025-59438 micropython: MbedTLS Padding oracle through timing of cipher error reporting [fedora-all]

BZ#2437327 CVE-2026-1998 micropython: micropython runtime.c mp_import_all memory corruption [fedora-all]

BZ#2454032 CVE-2026-25833 micropython: buffer underflow in x509_inet_pton_ipv6() [fedora-all]

BZ#2454086 CVE-2026-34871 micropython: entropy on Linux can fall back to /dev/urandom [fedora-all]

BZ#2454213 CVE-2026-25834 micropython: Mbed TLS: Algorithm downgrade vulnerability [fedora-all]

BZ#2455368 micropython-1.28.0 is available

micropython-1.28.0-1.fc45

Automated Test Results

ignored