From de8a0d3fdb6e6b33fb6aa1883af9496e28fad3dc Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Mon, 22 Jun 2026 22:29:15 +0100 Subject: [PATCH 1/3] Added CVE Signed-off-by: Minos Galanakis --- ChangeLog.d/tls13-hrr-selected-group.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog.d/tls13-hrr-selected-group.txt b/ChangeLog.d/tls13-hrr-selected-group.txt index 20d7a18fbd..c318b393fc 100644 --- a/ChangeLog.d/tls13-hrr-selected-group.txt +++ b/ChangeLog.d/tls13-hrr-selected-group.txt @@ -2,4 +2,4 @@ Security * Fix TLS 1.3 clients to reject a HelloRetryRequest whose selected group was not advertised in the original ClientHello. Reported by Din Asotić / Xiangdong Li, Beijing University of Posts and - Telecommunications (BUPT) + Telecommunications (BUPT). CVE-2026-25832 From 567a3a443d5029ef1e2ada99d290152dcbbf08c3 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Mon, 22 Jun 2026 22:32:25 +0100 Subject: [PATCH 2/3] Added attribution Signed-off-by: Minos Galanakis --- ChangeLog.d/tls13-hrr-selected-group.txt | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/ChangeLog.d/tls13-hrr-selected-group.txt b/ChangeLog.d/tls13-hrr-selected-group.txt index c318b393fc..4c338480f6 100644 --- a/ChangeLog.d/tls13-hrr-selected-group.txt +++ b/ChangeLog.d/tls13-hrr-selected-group.txt @@ -1,5 +1,7 @@ Security * Fix TLS 1.3 clients to reject a HelloRetryRequest whose selected group was - not advertised in the original ClientHello. Reported by + not advertised in the original ClientHello. Reported independently by Din Asotić / Xiangdong Li, Beijing University of Posts and - Telecommunications (BUPT). CVE-2026-25832 + Telecommunications (BUPT), and NVIDIA Project Vanessa. + CVE-2026-25832. + From f722436e4619494cda0dc58f2efd09857d329f1d Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Wed, 24 Jun 2026 14:36:00 +0100 Subject: [PATCH 3/3] Changelog. Added attribution/CVE for 1569 Signed-off-by: Minos Galanakis --- ChangeLog.d/security-issue1569.txt | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ChangeLog.d/security-issue1569.txt b/ChangeLog.d/security-issue1569.txt index c7d3ca0782..c9e285b80e 100644 --- a/ChangeLog.d/security-issue1569.txt +++ b/ChangeLog.d/security-issue1569.txt @@ -1,4 +1,7 @@ Security * Improved documentation of mbedtls_ssl_conf_sig_algs() to emphasize that this function only sets signature algorithms that are enforced during - TLS key exchange and not on certificate verification. + TLS key exchange and not on certificate verification. Reported by + Xiangdong Li, Beijing University of Posts and Telecommunications (BUPT). + CVE-2026-54441 +