From e3be807e5c5ce216b8b832b1e746e4ef5c0765bf Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Mon, 11 May 2026 15:22:09 +0100 Subject: [PATCH 1/6] Add fix for OOB key exchange error Signed-off-by: Ben Taylor --- library/ssl_tls12_client.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/library/ssl_tls12_client.c b/library/ssl_tls12_client.c index a56e8cd11c..17ea5e92d0 100644 --- a/library/ssl_tls12_client.c +++ b/library/ssl_tls12_client.c @@ -2283,6 +2283,8 @@ start_processing: * However since we only support secp256r1 for now, we check only * that TLS ID here */ + MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 3); + uint16_t read_tls_id = MBEDTLS_GET_UINT16_BE(p, 1); uint16_t exp_tls_id = mbedtls_ssl_get_tls_id_from_ecp_group_id( MBEDTLS_ECP_DP_SECP256R1); From 723cbadb530e2a488eca0419253fd301eb926d7a Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Tue, 12 May 2026 14:41:06 +0100 Subject: [PATCH 2/6] Add ChangeLog Signed-off-by: Ben Taylor --- ChangeLog.d/oob-key-exchange-restricted.txt | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 ChangeLog.d/oob-key-exchange-restricted.txt diff --git a/ChangeLog.d/oob-key-exchange-restricted.txt b/ChangeLog.d/oob-key-exchange-restricted.txt new file mode 100644 index 0000000000..a0e698c077 --- /dev/null +++ b/ChangeLog.d/oob-key-exchange-restricted.txt @@ -0,0 +1,3 @@ +Security + * Fix an out-of-bounds read in TLS 1.2 ECJPAKE ServerKeyExchange parsing. + Reported-by Biniam Demissie From b4618212239a8ad4911e1e5a1b84101d2a57e00c Mon Sep 17 00:00:00 2001 From: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com> Date: Mon, 8 Jun 2026 15:13:02 +0100 Subject: [PATCH 3/6] Improve the wording of the ChangeLog Co-authored-by: Ronald Cron Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com> --- ChangeLog.d/oob-key-exchange-restricted.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog.d/oob-key-exchange-restricted.txt b/ChangeLog.d/oob-key-exchange-restricted.txt index a0e698c077..a4bfe738b2 100644 --- a/ChangeLog.d/oob-key-exchange-restricted.txt +++ b/ChangeLog.d/oob-key-exchange-restricted.txt @@ -1,3 +1,3 @@ Security - * Fix an out-of-bounds read in TLS 1.2 ECJPAKE ServerKeyExchange parsing. + * Fix an out-of-bounds read when parsing TLS 1.2 ECJPAKE ServerKeyExchange messages. Reported-by Biniam Demissie From 9befdba49ebcb0cd1fe6ab36989b65c6eb48160d Mon Sep 17 00:00:00 2001 From: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com> Date: Mon, 8 Jun 2026 15:13:37 +0100 Subject: [PATCH 4/6] Add CVE to ChangeLog Co-authored-by: Ronald Cron Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com> --- ChangeLog.d/oob-key-exchange-restricted.txt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ChangeLog.d/oob-key-exchange-restricted.txt b/ChangeLog.d/oob-key-exchange-restricted.txt index a4bfe738b2..62e613648b 100644 --- a/ChangeLog.d/oob-key-exchange-restricted.txt +++ b/ChangeLog.d/oob-key-exchange-restricted.txt @@ -1,3 +1,4 @@ Security * Fix an out-of-bounds read when parsing TLS 1.2 ECJPAKE ServerKeyExchange messages. - Reported-by Biniam Demissie + Reported-by Biniam Demissie. + CVE-2026-50588 From 0421e88ce137bff167e0ccd318d50b2b022a1d2b Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Wed, 10 Jun 2026 08:21:05 +0100 Subject: [PATCH 5/6] Correct ChangeLog style Signed-off-by: Ben Taylor --- ChangeLog.d/oob-key-exchange-restricted.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ChangeLog.d/oob-key-exchange-restricted.txt b/ChangeLog.d/oob-key-exchange-restricted.txt index 62e613648b..6a250644b9 100644 --- a/ChangeLog.d/oob-key-exchange-restricted.txt +++ b/ChangeLog.d/oob-key-exchange-restricted.txt @@ -1,4 +1,4 @@ Security - * Fix an out-of-bounds read when parsing TLS 1.2 ECJPAKE ServerKeyExchange messages. - Reported-by Biniam Demissie. + * Fix an out-of-bounds read when parsing TLS 1.2 ECJPAKE ServerKeyExchange + messages. Reported-by Biniam Demissie. CVE-2026-50588 From e1351f7881991951049fdcca230edd85dcde6f90 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Wed, 10 Jun 2026 14:15:48 +0100 Subject: [PATCH 6/6] Fix style issue Signed-off-by: Ben Taylor --- ChangeLog.d/oob-key-exchange-restricted.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog.d/oob-key-exchange-restricted.txt b/ChangeLog.d/oob-key-exchange-restricted.txt index 6a250644b9..2e48ce0fec 100644 --- a/ChangeLog.d/oob-key-exchange-restricted.txt +++ b/ChangeLog.d/oob-key-exchange-restricted.txt @@ -1,4 +1,4 @@ Security - * Fix an out-of-bounds read when parsing TLS 1.2 ECJPAKE ServerKeyExchange + * Fix an out-of-bounds read when parsing TLS 1.2 ECJPAKE ServerKeyExchange messages. Reported-by Biniam Demissie. CVE-2026-50588