manifest: mbedtls: bump to 3.6.5 #98786

valeriosetti · 2025-11-03T13:46:09Z

Update Mbed TLS revision to 3.6.5 release.

This PR depends on zephyrproject-rtos/mbedtls#79

github-actions · 2025-11-03T13:47:34Z

The following west manifest projects have changed revision in this Pull Request:

Name	Old Revision	New Revision	Diff
mbedtls	zephyrproject-rtos/mbedtls@`f4c0283`	zephyrproject-rtos/mbedtls@`c5b06d8` (`zephyr_mbedtls_v3.6.5`)	zephyrproject-rtos/[email protected]

✅ All manifest checks OK

Note: This message is automatically posted and updated by the Manifest GitHub Action.

tomi-font

don't forget the release notes entry as well

tomi-font

Maybe we should also explicitly mention the CVEs fixed by this Mbed TLS release at the top of the file?
See for example:

zephyr/doc/releases/release-notes-4.2.rst

Lines 69 to 75 in bde3e69

    
           Security Vulnerability Related 
        
           ****************************** 
        
           The following CVEs are addressed by this release: 
        
           * :cve:`2025-27809` `TLS clients may unwittingly skip server authentication 
        
             <https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-03-1/>`_

tomi-font · 2025-11-04T08:41:22Z

@ceolin @d3zd3z @jhedberg @cfriedt This is probably worth getting in for 4.3? needs one more review on zephyrproject-rtos/mbedtls#79

jhedberg · 2025-11-04T08:48:34Z

@ceolin @d3zd3z @jhedberg @cfriedt This is probably worth getting in for 4.3? needs one more review on zephyrproject-rtos/mbedtls#79

This is a strange time to see proposals for module updates. Is this some release that happened after our rc1, and has some critical fixes we need for the release? Why wasn't this done before rc1 as part of #97555?

tomi-font · 2025-11-04T09:19:34Z

This is a strange time to see proposals for module updates. Is this some release that happened after our rc1, and has some critical fixes we need for the release? Why wasn't this done before rc1 as part of #97555?

Hmm yeah admittedly a bit late to the party, this bugfix release happened some weeks ago, it just has two medium security fixes. The Mbed TLS module PR was raised exactly 3 weeks ago by @valeriosetti but has received little attention so far.

Why wasn't this done before rc1 as part of #97555?

As for this question, well... I wasn't even aware of this issue. @d3zd3z is meant to be the maintainer but hasn't been active in maintaining Mbed TLS/TF-M.

Not that big of a deal if this is too much too late for 4.3.

doc/releases/release-notes-4.4.rst

jhedberg · 2025-11-04T12:45:24Z

I think this could (perhaps should) be considered still for 4.3. However, what's with the failing CI tests?

doc/releases/release-notes-4.4.rst

jhedberg

Looks fine, but please don't forget to thet the module PR merged and then update west.yml here.

Update Mbed TLS revision from 3.6.4 to 3.6.5. Signed-off-by: Valerio Setti <[email protected]>

doc/releases/release-notes-4.4.rst

Add a note about Mbed TLS version upgrade from 3.6.4 to 3.6.5. Update also the CVE list accordingly. Signed-off-by: Valerio Setti <[email protected]>

Enable retransmissions of Generic Provisioning PDUs. This should fix pb_cancel test where provisionee fails to receive Link Open PDU due to parallel PB-GATT advertisement, but since Link Open PDU is not retransmitted, test fails. Signed-off-by: Pavel Vasilyev <[email protected]>

Add delay to avoid missed packet by tester. This fixes brg_subnet_duplicate_filtering test. Signed-off-by: Pavel Vasilyev <[email protected]>

jhedberg · 2025-11-06T10:16:21Z

@valeriosetti since this was opened after rc2 it needs a bug report reference as well

sonarqubecloud · 2025-11-06T10:21:07Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

valeriosetti requested a review from tomi-font November 3, 2025 13:46

github-actions bot added manifest manifest-mbedtls DNM (manifest) This PR should not be merged (controlled by action-manifest) labels Nov 3, 2025

zephyrbot added area: mbedTLS / PSA Crypto size: XS A PR changing only a single line of code labels Nov 3, 2025

zephyrbot requested review from ceolin, d3zd3z, ithinuel and wearyzen November 3, 2025 13:47

zephyrbot assigned d3zd3z and ceolin Nov 3, 2025

valeriosetti force-pushed the mbedtls-bump-3.6.5 branch from 2439a5b to 1c03604 Compare November 3, 2025 13:48

valeriosetti requested a review from dleach02 November 3, 2025 14:18

tomi-font previously approved these changes Nov 4, 2025

View reviewed changes

valeriosetti dismissed tomi-font’s stale review via b93884a November 4, 2025 08:35

zephyrbot added the Release Notes To be mentioned in the release notes label Nov 4, 2025

zephyrbot requested review from cfriedt, jhedberg and kartben November 4, 2025 08:37

tomi-font reviewed Nov 4, 2025

View reviewed changes

valeriosetti force-pushed the mbedtls-bump-3.6.5 branch from b93884a to 6c91bfb Compare November 4, 2025 09:00

tomi-font reviewed Nov 4, 2025

View reviewed changes

doc/releases/release-notes-4.4.rst Outdated Show resolved Hide resolved

valeriosetti force-pushed the mbedtls-bump-3.6.5 branch from 6c91bfb to 5159675 Compare November 4, 2025 10:22

tomi-font reviewed Nov 5, 2025

View reviewed changes

doc/releases/release-notes-4.4.rst Outdated Show resolved Hide resolved

zephyrbot requested a review from PavelVPV November 5, 2025 12:28

PavelVPV previously approved these changes Nov 5, 2025

View reviewed changes

jhedberg previously approved these changes Nov 5, 2025

View reviewed changes

tomi-font added this to the v4.3.0 milestone Nov 6, 2025

manifest: mbedtls: bump to 3.6.5

f1255db

Update Mbed TLS revision from 3.6.4 to 3.6.5. Signed-off-by: Valerio Setti <[email protected]>

valeriosetti dismissed stale reviews from jhedberg and PavelVPV via bfc02c1 November 6, 2025 08:26

valeriosetti force-pushed the mbedtls-bump-3.6.5 branch from 84f00b4 to bfc02c1 Compare November 6, 2025 08:26

github-actions bot removed the DNM (manifest) This PR should not be merged (controlled by action-manifest) label Nov 6, 2025

zephyrbot requested review from PavelVPV, jhedberg and nashif November 6, 2025 08:29

PavelVPV previously approved these changes Nov 6, 2025

View reviewed changes

tomi-font reviewed Nov 6, 2025

View reviewed changes

doc/releases/release-notes-4.4.rst Show resolved Hide resolved

valeriosetti and others added 3 commits November 6, 2025 10:53

doc: release-notes: notify about Mbed TLS version upgrade

937f249

Add a note about Mbed TLS version upgrade from 3.6.4 to 3.6.5. Update also the CVE list accordingly. Signed-off-by: Valerio Setti <[email protected]>

tests: bsim: bluetooth: mesh: Fix brg duplicate filtering test

a695949

Add delay to avoid missed packet by tester. This fixes brg_subnet_duplicate_filtering test. Signed-off-by: Pavel Vasilyev <[email protected]>

valeriosetti dismissed PavelVPV’s stale review via a695949 November 6, 2025 09:54

valeriosetti force-pushed the mbedtls-bump-3.6.5 branch from bfc02c1 to a695949 Compare November 6, 2025 09:54

valeriosetti requested a review from tomi-font November 6, 2025 09:54

zephyrbot requested a review from PavelVPV November 6, 2025 09:56

tomi-font approved these changes Nov 6, 2025

View reviewed changes

PavelVPV approved these changes Nov 6, 2025

View reviewed changes

valeriosetti linked an issue Nov 6, 2025 that may be closed by this pull request

Update Mbed TLS to version 3.6.5 #98994

Closed

1 task

jhedberg approved these changes Nov 6, 2025

View reviewed changes

ceolin approved these changes Nov 6, 2025

View reviewed changes

cfriedt merged commit cce11a5 into zephyrproject-rtos:main Nov 6, 2025
30 checks passed

tomi-font mentioned this pull request Nov 11, 2025

manifest: tf-m: include fix for Mbed TLS cipher interface #99161

Merged

	Security Vulnerability Related
	******************************

	The following CVEs are addressed by this release:

	* :cve:`2025-27809` `TLS clients may unwittingly skip server authentication
	<https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-03-1/>`_

manifest: mbedtls: bump to 3.6.5 #98786

manifest: mbedtls: bump to 3.6.5 #98786

Uh oh!

Conversation

valeriosetti commented Nov 3, 2025 • edited by jhedberg Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Nov 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tomi-font left a comment

Choose a reason for hiding this comment

Uh oh!

tomi-font left a comment

Choose a reason for hiding this comment

Uh oh!

tomi-font commented Nov 4, 2025

Uh oh!

jhedberg commented Nov 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tomi-font commented Nov 4, 2025

Uh oh!

Uh oh!

jhedberg commented Nov 4, 2025

Uh oh!

Uh oh!

jhedberg left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jhedberg commented Nov 6, 2025

Uh oh!

sonarqubecloud bot commented Nov 6, 2025

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

valeriosetti commented Nov 3, 2025 •

edited by jhedberg

Loading

github-actions bot commented Nov 3, 2025 •

edited

Loading

jhedberg commented Nov 4, 2025 •

edited

Loading