diff --git a/ChangeLog b/ChangeLog index b7a79ce348..2cd99dc8f2 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,107 @@ Mbed TLS ChangeLog (Sorted per branch, date) += Mbed TLS 4.1.1 branch released 2026-07-07 + +Features + * Restore DESTDIR support for CMake installs of compatibility + libmbedcrypto symlinks. Fixes #10627. + * SHA3-256, SHA3-384 and SHA3-512 are now accepted in the default X.509 + certificate profile. + +Security + * Added advice about compiler options in SECURITY.md. + * Fix a bug where transcript-hash computation errors during TLS 1.2 + extended master secret calculation could be ignored instead of causing the + handshake to fail. This could allow a handshake to continue with a master + secret that was not correctly bound to the handshake transcript, + undermining the security guarantees of the extended master secret + extension. Report by Mathew Gretton-Dann. CVE-2026-50581 + * Fix a TLS 1.3 server-side error-handling bug affecting session ticket + generation. Under rare conditions, such as memory allocation failures + while computing the resumption master secret, the server could issue + invalid session tickets instead of failing the handshake. Clients + presented with such tickets would fail session resumption and fall back to + a full handshake. In deployments relying on session resumption, repeated + occurrences could increase the frequency of full handshakes and amplify + resource consumption during periods of resource exhaustion or other + transient failures. Reported by jjfz123. + CVE-2026-50640 + * Fixed a TLS 1.3 record-boundary validation issue that could allow + unauthenticated plaintext data to be processed across a key change. In + servers with MBEDTLS_SSL_EARLY_DATA enabled, this could be exploited by a + man-in-the-middle attacker to cause loss of 0-RTT early data. + Reported by Ben Smyth. + CVE-2026-TODO. + * Fix a remote buffer overflow in (D)TLS with ECDHE-PSK cipher suites when + CBC is disabled. Reported by Karnakar Reddy. CVE-ID-50580 + * Fix a potential information disclosure in TLS 1.2 servers using session + tickets. If the session ticket write callback failed without setting the + lifetime output parameter, Mbed TLS could send 4 bytes of uninitialized + stack memory to the peer in the NewSessionTicket message. Fixes #1570. + Reported by James Love. CVE-2026-50586. + * Fix an out-of-bounds read when parsing TLS 1.2 ECJPAKE ServerKeyExchange + messages. Reported-by Biniam Demissie. + CVE-2026-50588 + * Fix a use-after-free/double-free risk in mbedtls_pkcs7_free() when reusing + an mbedtls_pkcs7 context across parse -> free -> parse -> free cycles. The + function now resets the context after freeing it, ensuring stale + signed_data.signers.next pointers cannot be walked by a later free + operation. CVE-2026-50579 + * PKCS7 now rejects weak hash algorithms (RIPEMD160, MD5, SHA-1, SHA-224, + SHA3-224) on signature verification. The new configuration option + MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES allows to keep using weak hash + algorithms in PKCS7 for backward compatibility purposes. + * Improved documentation of mbedtls_ssl_conf_sig_algs() to emphasize that + this function only sets signature algorithms that are enforced during + TLS key exchange and not on certificate verification. Reported by + Xiangdong Li, Beijing University of Posts and Telecommunications (BUPT). + CVE-2026-54441 + * Ensure 'badmac_seen' and 'dtls_srtp_info' fields from 'mbedtls_ssl_context' + are properly zeroized when mbedtls_ssl_session_reset() is called. This + could cause premature DTLS connection failure or incorrect DTLS-SRTP + parameter inheritance for applications reusing an SSL context. + Reported by jjfz123. CVE-2026-50585. + * Fix a bug where mbedtls_ssl_read() and mbedtls_ssl_write() could return + 1 instead of an error code if the random generator failed when a server + called these functions before the end of a TLS 1.3 handshake. + Reported by Mohammad Seet (mhdsait101). CVE-2026-40294 + * Fix TLS 1.3 clients to reject a HelloRetryRequest whose selected group was + not advertised in the original ClientHello. Reported independently by + Din Asotić / Xiangdong Li, Beijing University of Posts and + Telecommunications (BUPT), and NVIDIA Project Vanessa. + CVE-2026-25832. + * Fix two bugs in the X.509 certificate parser that caused some inputs + with a malformed basicConstraints extension to be accepted. This + could have dangerous results, in particular causing some certificates + to be parsed as CA certificates when other X.509 implementations would + parse them as end-entity certificates. Reported by Mohammad Seet + (mhdsait101), Pablo Ruiz García and NVIDIA Project Vanessa. CVE-2026-49300 + +Bugfix + * Fix a TLS 1.2 regression that caused clients to reject valid + ServerKeyExchange signatures using RSA-PSS signature algorithms. + Fixes #10668. + * Fix a build error using the LLVM based MinGW toolchain. + Bug reported and fix contributed by valord577. + * Fixed a bug which prevented the inclusion of standard C library header + files from the user provided configuration file. Fixes #10740. + * Reject malformed TLS 1.3 serialized sessions instead of accepting + unterminated strings or extra trailing data. + * Reject serialized SSL contexts whose DTLS Connection ID length exceeds + the maximum supported size, instead of overflowing the internal buffer. + * Fixed documentation of mbedtls_ssl_set_cid(): the set CID configuration + is applied to all subsequent handshakes, not just to the next one. + * Reject malformed X.509 CSRs where the extensionRequest attribute + wrappers do not exactly contain the requested extensions. + +Changes + * X.509 certificates with a basicConstraints extension starting with an + INTEGER field are no longer accepted. According to RFC 5280, such + certificates are syntactically valid and the first field is the + pathLenConstraint value, but certificate authorities must not emit such + certificates. Mbed TLS interpreted it as a cA value, which was nonstandard + and dangerous. + = Mbed TLS 4.1.0 branch released 2026-03-31 API changes diff --git a/ChangeLog.d/1583-1584-ssl-transcript-errors.txt b/ChangeLog.d/1583-1584-ssl-transcript-errors.txt deleted file mode 100644 index f259bd711e..0000000000 --- a/ChangeLog.d/1583-1584-ssl-transcript-errors.txt +++ /dev/null @@ -1,17 +0,0 @@ -Security - * Fix a bug where transcript-hash computation errors during TLS 1.2 - extended master secret calculation could be ignored instead of causing the - handshake to fail. This could allow a handshake to continue with a master - secret that was not correctly bound to the handshake transcript, - undermining the security guarantees of the extended master secret - extension. Report by Mathew Gretton-Dann. CVE-2026-50581 - * Fix a TLS 1.3 server-side error-handling bug affecting session ticket - generation. Under rare conditions, such as memory allocation failures - while computing the resumption master secret, the server could issue - invalid session tickets instead of failing the handshake. Clients - presented with such tickets would fail session resumption and fall back to - a full handshake. In deployments relying on session resumption, repeated - occurrences could increase the frequency of full handshakes and amplify - resource consumption during periods of resource exhaustion or other - transient failures. Reported by jjfz123. - CVE-2026-50640 diff --git a/ChangeLog.d/cmake-destdir-instal.txt b/ChangeLog.d/cmake-destdir-instal.txt deleted file mode 100644 index 1638a4bea9..0000000000 --- a/ChangeLog.d/cmake-destdir-instal.txt +++ /dev/null @@ -1,3 +0,0 @@ -Features - * Restore DESTDIR support for CMake installs of compatibility - libmbedcrypto symlinks. Fixes #10627. diff --git a/ChangeLog.d/drop-early-data.txt b/ChangeLog.d/drop-early-data.txt deleted file mode 100644 index dc597a23f0..0000000000 --- a/ChangeLog.d/drop-early-data.txt +++ /dev/null @@ -1,7 +0,0 @@ -Security - * Fixed a TLS 1.3 record-boundary validation issue that could allow - unauthenticated plaintext data to be processed across a key change. In - servers with MBEDTLS_SSL_EARLY_DATA enabled, this could be exploited by a - man-in-the-middle attacker to cause loss of 0-RTT early data. - Reported by Ben Smyth. - CVE-2026-TODO. diff --git a/ChangeLog.d/ecdh-psk-integer-overflow.txt b/ChangeLog.d/ecdh-psk-integer-overflow.txt deleted file mode 100644 index 3ed448ee16..0000000000 --- a/ChangeLog.d/ecdh-psk-integer-overflow.txt +++ /dev/null @@ -1,3 +0,0 @@ -Security - * Fix a remote buffer overflow in (D)TLS with ECDHE-PSK cipher suites when - CBC is disabled. Reported by Karnakar Reddy. CVE-ID-50580 diff --git a/ChangeLog.d/fix-info-leak-in-ssl.txt b/ChangeLog.d/fix-info-leak-in-ssl.txt deleted file mode 100644 index 2a0309fc40..0000000000 --- a/ChangeLog.d/fix-info-leak-in-ssl.txt +++ /dev/null @@ -1,6 +0,0 @@ -Security - * Fix a potential information disclosure in TLS 1.2 servers using session - tickets. If the session ticket write callback failed without setting the - lifetime output parameter, Mbed TLS could send 4 bytes of uninitialized - stack memory to the peer in the NewSessionTicket message. Fixes #1570. - Reported by James Love. CVE-2026-50586. diff --git a/ChangeLog.d/fix-tls12-rsa-pss-sigalgs.txt b/ChangeLog.d/fix-tls12-rsa-pss-sigalgs.txt deleted file mode 100644 index 34296b602e..0000000000 --- a/ChangeLog.d/fix-tls12-rsa-pss-sigalgs.txt +++ /dev/null @@ -1,4 +0,0 @@ -Bugfix - * Fix a TLS 1.2 regression that caused clients to reject valid - ServerKeyExchange signatures using RSA-PSS signature algorithms. - Fixes #10668. diff --git a/ChangeLog.d/issue10740.txt b/ChangeLog.d/issue10740.txt deleted file mode 100644 index eb7a36c063..0000000000 --- a/ChangeLog.d/issue10740.txt +++ /dev/null @@ -1,3 +0,0 @@ -Bugfix - * Fixed a bug which prevented the inclusion of standard C library header - files from the user provided configuration file. Fixes #10740. diff --git a/ChangeLog.d/mbedtls_ssl_set_cid-documentation.txt b/ChangeLog.d/mbedtls_ssl_set_cid-documentation.txt deleted file mode 100644 index 1ad970fdfb..0000000000 --- a/ChangeLog.d/mbedtls_ssl_set_cid-documentation.txt +++ /dev/null @@ -1,3 +0,0 @@ -Bugfix - * Fixed documentation of mbedtls_ssl_set_cid(): the set CID configuration - is applied to all subsequent handshakes, not just to the next one. diff --git a/ChangeLog.d/oob-key-exchange-restricted.txt b/ChangeLog.d/oob-key-exchange-restricted.txt deleted file mode 100644 index 2e48ce0fec..0000000000 --- a/ChangeLog.d/oob-key-exchange-restricted.txt +++ /dev/null @@ -1,4 +0,0 @@ -Security - * Fix an out-of-bounds read when parsing TLS 1.2 ECJPAKE ServerKeyExchange - messages. Reported-by Biniam Demissie. - CVE-2026-50588 diff --git a/ChangeLog.d/pkcs-free-stale-pointers.txt b/ChangeLog.d/pkcs-free-stale-pointers.txt deleted file mode 100644 index 2c29fed5ef..0000000000 --- a/ChangeLog.d/pkcs-free-stale-pointers.txt +++ /dev/null @@ -1,6 +0,0 @@ -Security - * Fix a use-after-free/double-free risk in mbedtls_pkcs7_free() when reusing - an mbedtls_pkcs7 context across parse -> free -> parse -> free cycles. The - function now resets the context after freeing it, ensuring stale - signed_data.signers.next pointers cannot be walked by a later free - operation. CVE-2026-50579 diff --git a/ChangeLog.d/pkcs7-reject-weak-hashes.txt b/ChangeLog.d/pkcs7-reject-weak-hashes.txt deleted file mode 100644 index ce3f295db1..0000000000 --- a/ChangeLog.d/pkcs7-reject-weak-hashes.txt +++ /dev/null @@ -1,9 +0,0 @@ -Security - * PKCS7 now rejects weak hash algorithms (RIPEMD160, MD5, SHA-1, SHA-224, - SHA3-224) on signature verification. The new configuration option - MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES allows to keep using weak hash - algorithms in PKCS7 for backward compatibility purposes. - -Features - * SHA3-256, SHA3-384 and SHA3-512 are now accepted in the default X.509 - certificate profile. diff --git a/ChangeLog.d/pr_10695__fix_build_llvm_mingw.txt b/ChangeLog.d/pr_10695__fix_build_llvm_mingw.txt deleted file mode 100644 index 3fed87143f..0000000000 --- a/ChangeLog.d/pr_10695__fix_build_llvm_mingw.txt +++ /dev/null @@ -1,3 +0,0 @@ -Bugfix - * Fix a build error using the LLVM based MinGW toolchain. - Bug reported and fix contributed by valord577. diff --git a/ChangeLog.d/security-advice.txt b/ChangeLog.d/security-advice.txt deleted file mode 100644 index 1f7677a882..0000000000 --- a/ChangeLog.d/security-advice.txt +++ /dev/null @@ -1,2 +0,0 @@ -Security - * Added advice about compiler options in SECURITY.md. diff --git a/ChangeLog.d/security-issue1569.txt b/ChangeLog.d/security-issue1569.txt deleted file mode 100644 index c9e285b80e..0000000000 --- a/ChangeLog.d/security-issue1569.txt +++ /dev/null @@ -1,7 +0,0 @@ -Security - * Improved documentation of mbedtls_ssl_conf_sig_algs() to emphasize that - this function only sets signature algorithms that are enforced during - TLS key exchange and not on certificate verification. Reported by - Xiangdong Li, Beijing University of Posts and Telecommunications (BUPT). - CVE-2026-54441 - diff --git a/ChangeLog.d/security1585.txt b/ChangeLog.d/security1585.txt deleted file mode 100644 index f9f21691db..0000000000 --- a/ChangeLog.d/security1585.txt +++ /dev/null @@ -1,6 +0,0 @@ -Security - * Ensure 'badmac_seen' and 'dtls_srtp_info' fields from 'mbedtls_ssl_context' - are properly zeroized when mbedtls_ssl_session_reset() is called. This - could cause premature DTLS connection failure or incorrect DTLS-SRTP - parameter inheritance for applications reusing an SSL context. - Reported by jjfz123. CVE-2026-50585. diff --git a/ChangeLog.d/serialized-data-load-hardening.txt b/ChangeLog.d/serialized-data-load-hardening.txt deleted file mode 100644 index e068988dac..0000000000 --- a/ChangeLog.d/serialized-data-load-hardening.txt +++ /dev/null @@ -1,5 +0,0 @@ -Bugfix - * Reject malformed TLS 1.3 serialized sessions instead of accepting - unterminated strings or extra trailing data. - * Reject serialized SSL contexts whose DTLS Connection ID length exceeds - the maximum supported size, instead of overflowing the internal buffer. diff --git a/ChangeLog.d/ssl_tls13_prepare_new_session_ticket-psa_get_random.txt b/ChangeLog.d/ssl_tls13_prepare_new_session_ticket-psa_get_random.txt deleted file mode 100644 index b020546b12..0000000000 --- a/ChangeLog.d/ssl_tls13_prepare_new_session_ticket-psa_get_random.txt +++ /dev/null @@ -1,5 +0,0 @@ -Security - * Fix a bug where mbedtls_ssl_read() and mbedtls_ssl_write() could return - 1 instead of an error code if the random generator failed when a server - called these functions before the end of a TLS 1.3 handshake. - Reported by Mohammad Seet (mhdsait101). CVE-2026-40294 diff --git a/ChangeLog.d/tls13-hrr-selected-group.txt b/ChangeLog.d/tls13-hrr-selected-group.txt deleted file mode 100644 index 4c338480f6..0000000000 --- a/ChangeLog.d/tls13-hrr-selected-group.txt +++ /dev/null @@ -1,7 +0,0 @@ -Security - * Fix TLS 1.3 clients to reject a HelloRetryRequest whose selected group was - not advertised in the original ClientHello. Reported independently by - Din Asotić / Xiangdong Li, Beijing University of Posts and - Telecommunications (BUPT), and NVIDIA Project Vanessa. - CVE-2026-25832. - diff --git a/ChangeLog.d/x509-crt-parse-basicConstraints.txt b/ChangeLog.d/x509-crt-parse-basicConstraints.txt deleted file mode 100644 index 251dc8f0fd..0000000000 --- a/ChangeLog.d/x509-crt-parse-basicConstraints.txt +++ /dev/null @@ -1,15 +0,0 @@ -Security - * Fix two bugs in the X.509 certificate parser that caused some inputs - with a malformed basicConstraints extension to be accepted. This - could have dangerous results, in particular causing some certificates - to be parsed as CA certificates when other X.509 implementations would - parse them as end-entity certificates. Reported by Mohammad Seet - (mhdsait101), Pablo Ruiz García and NVIDIA Project Vanessa. CVE-2026-49300 - -Changes - * X.509 certificates with a basicConstraints extension starting with an - INTEGER field are no longer accepted. According to RFC 5280, such - certificates are syntactically valid and the first field is the - pathLenConstraint value, but certificate authorities must not emit such - certificates. Mbed TLS interpreted it as a cA value, which was nonstandard - and dangerous. diff --git a/ChangeLog.d/x509-csr-extension-request-bounds.txt b/ChangeLog.d/x509-csr-extension-request-bounds.txt deleted file mode 100644 index dfc706703c..0000000000 --- a/ChangeLog.d/x509-csr-extension-request-bounds.txt +++ /dev/null @@ -1,3 +0,0 @@ -Bugfix - * Reject malformed X.509 CSRs where the extensionRequest attribute - wrappers do not exactly contain the requested extensions.