From 71c6e06676f745d2dd7042ff36b91d2798fbed30 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Fri, 26 Jun 2026 15:33:48 +0100 Subject: [PATCH] Assemble ChangeLog ./framework/scripts/assemble_changelog.py Signed-off-by: Minos Galanakis --- ChangeLog | 131 ++++++++++++++++++ .../1583-1584-ssl-transcript-errors.txt | 17 --- ChangeLog.d/badmac_seen_or_in_hsfraglen.txt | 4 - ChangeLog.d/chacha20-counter-overflow.txt | 4 - ChangeLog.d/drop-early-data.txt | 7 - ChangeLog.d/ecdh-legacy-buffer-overflow.txt | 6 - ChangeLog.d/ecdh-psk-integer-overflow.txt | 3 - ChangeLog.d/ecp-modp-side-channel.txt | 6 - ChangeLog.d/fix-ecdh-context-reuse.txt | 4 - ChangeLog.d/fix-info-leak-in-ssl.txt | 6 - ChangeLog.d/fix-tls12-rsa-pss-sigalgs.txt | 4 - ChangeLog.d/harden-check-small-primes.txt | 5 - ChangeLog.d/iar-alignment-fix.txt | 6 - ChangeLog.d/mbedtls_pk_ecc_set_pubkey.txt | 4 - .../mbedtls_ssl_set_cid-documentation.txt | 3 - ChangeLog.d/oob-key-exchange-restricted.txt | 4 - ChangeLog.d/pkcs-free-stale-pointers.txt | 6 - ChangeLog.d/pkcs7-reject-weak-hashes.txt | 9 -- ChangeLog.d/rsa-padding.txt | 8 -- ChangeLog.d/security-advice.txt | 2 - ChangeLog.d/security-issue1569.txt | 7 - ChangeLog.d/security1585.txt | 6 - .../serialized-data-load-hardening.txt | 5 - ...pare_new_session_ticket-psa_get_random.txt | 5 - ChangeLog.d/tls13-hrr-selected-group.txt | 7 - .../x509-crt-parse-basicConstraints.txt | 15 -- .../x509-csr-extension-request-bounds.txt | 3 - 27 files changed, 131 insertions(+), 156 deletions(-) delete mode 100644 ChangeLog.d/1583-1584-ssl-transcript-errors.txt delete mode 100644 ChangeLog.d/badmac_seen_or_in_hsfraglen.txt delete mode 100644 ChangeLog.d/chacha20-counter-overflow.txt delete mode 100644 ChangeLog.d/drop-early-data.txt delete mode 100644 ChangeLog.d/ecdh-legacy-buffer-overflow.txt delete mode 100644 ChangeLog.d/ecdh-psk-integer-overflow.txt delete mode 100644 ChangeLog.d/ecp-modp-side-channel.txt delete mode 100644 ChangeLog.d/fix-ecdh-context-reuse.txt delete mode 100644 ChangeLog.d/fix-info-leak-in-ssl.txt delete mode 100644 ChangeLog.d/fix-tls12-rsa-pss-sigalgs.txt delete mode 100644 ChangeLog.d/harden-check-small-primes.txt delete mode 100644 ChangeLog.d/iar-alignment-fix.txt delete mode 100644 ChangeLog.d/mbedtls_pk_ecc_set_pubkey.txt delete mode 100644 ChangeLog.d/mbedtls_ssl_set_cid-documentation.txt delete mode 100644 ChangeLog.d/oob-key-exchange-restricted.txt delete mode 100644 ChangeLog.d/pkcs-free-stale-pointers.txt delete mode 100644 ChangeLog.d/pkcs7-reject-weak-hashes.txt delete mode 100644 ChangeLog.d/rsa-padding.txt delete mode 100644 ChangeLog.d/security-advice.txt delete mode 100644 ChangeLog.d/security-issue1569.txt delete mode 100644 ChangeLog.d/security1585.txt delete mode 100644 ChangeLog.d/serialized-data-load-hardening.txt delete mode 100644 ChangeLog.d/ssl_tls13_prepare_new_session_ticket-psa_get_random.txt delete mode 100644 ChangeLog.d/tls13-hrr-selected-group.txt delete mode 100644 ChangeLog.d/x509-crt-parse-basicConstraints.txt delete mode 100644 ChangeLog.d/x509-csr-extension-request-bounds.txt diff --git a/ChangeLog b/ChangeLog index 17f09ac24f..63f5125083 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,136 @@ Mbed TLS ChangeLog (Sorted per branch, date) += Mbed TLS 3.6.7 branch released 2026-07-07 + +Features + * SHA3-256, SHA3-384 and SHA3-512 are now accepted in the default X.509 + certificate profile. + +Security + * Fix a side channel in RSA PKCS#1 v1.5 decryption: error handling in the + library would reveal through timing the difference between success, + invalid padding, or output too large for buffer, giving rise to a + Bleichenbacher attack. Note that while the library now handles sensitive + errors in constant-time, RSA PKCS#1 v1.5 decryption remains inherently + dangerous, should be avoided when possible, and otherwise requires great + care in application code. Found by zhengg. CVE-2026-50587 + * Added advice about compiler options in SECURITY.md. + * Fix a bug where transcript-hash computation errors during TLS 1.2 + extended master secret calculation could be ignored instead of causing the + handshake to fail. This could allow a handshake to continue with a master + secret that was not correctly bound to the handshake transcript, + undermining the security guarantees of the extended master secret + extension. Report by Mathew Gretton-Dann. CVE-2026-50581 + * Fix a TLS 1.3 server-side error-handling bug affecting session ticket + generation. Under rare conditions, such as memory allocation failures + while computing the resumption master secret, the server could issue + invalid session tickets instead of failing the handshake. Clients + presented with such tickets would fail session resumption and fall back to + a full handshake. In deployments relying on session resumption, repeated + occurrences could increase the frequency of full handshakes and amplify + resource consumption during periods of resource exhaustion or other + transient failures. Reported by jjfz123. + CVE-2026-50640 + * Fix renegotiation failing and potentially causing a buffer overflow + in DTLS when badmac_limit is enabled. Reported by Haruki Oyama. + CVE-2026-50713. + * Reject ChaCha20 operations that would make the 32-bit block counter wrap + around, which could otherwise reuse keystream and compromise + confidentiality. Reported by jiliang. CVE-2026-50584 + * Fixed a TLS 1.3 record-boundary validation issue that could allow + unauthenticated plaintext data to be processed across a key change. In + servers with MBEDTLS_SSL_EARLY_DATA enabled, this could be exploited by a + man-in-the-middle attacker to cause loss of 0-RTT early data. + Reported by Ben Smyth. + CVE-2026-TODO. + * Fix a possible buffer overflow in mbedtls_ecdh_calc_secret(): when the + provided output buffer is too small, sometimes (depending on the value of + the computed shared secret), the function would not return an error as it + should, but instead write past the end of the buffer. Reported by Eva + Crystal (0xiviel) from XSource Security. CVE-2026-35336. + * Fix a remote buffer overflow in (D)TLS with ECDHE-PSK cipher suites when + CBC is disabled. Reported by Karnakar Reddy. CVE-ID-50580 + * Fix a side channel in ECC computations that allows a powerful local + attacker (typically, untrusted OS attacking a secure enclave) to fully + recover long-term secret keys. Found and reported by Alejandro Cabrera + Aldaya from Tampere University. CVE-2026-54435 + * Fix a potential information disclosure in TLS 1.2 servers using session + tickets. If the session ticket write callback failed without setting the + lifetime output parameter, Mbed TLS could send 4 bytes of uninitialized + stack memory to the peer in the NewSessionTicket message. Fixes #1570. + Reported by James Love. CVE-2026-50586. + * Fix timing side channel in RSA key generation, prime generation and + primality testing, on platforms where division is not constant-time. At + this point this side channel is not known to be exploitable. Reported by + Bhargava Shastry, Ethereum Foundation. + * Fix a 1-byte buffer overread when parsing a malformed ECC public key + in the PK module. CVE-2026-50583 + * Fix an out-of-bounds read when parsing TLS 1.2 ECJPAKE ServerKeyExchange + messages. Reported-by Biniam Demissie. + CVE-2026-50588 + * Fix a use-after-free/double-free risk in mbedtls_pkcs7_free() when reusing + an mbedtls_pkcs7 context across parse -> free -> parse -> free cycles. The + function now resets the context after freeing it, ensuring stale + signed_data.signers.next pointers cannot be walked by a later free + operation. CVE-2026-50579 + * PKCS7 now rejects weak hash algorithms (RIPEMD160, MD5, SHA-1, SHA-224, + SHA3-224) on signature verification. The new configuration option + MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES allows to keep using weak hash + algorithms in PKCS7 for backward compatibility purposes. + * Improved documentation of mbedtls_ssl_conf_sig_algs() to emphasize that + this function only sets signature algorithms that are enforced during + TLS key exchange and not on certificate verification. Reported by + Xiangdong Li, Beijing University of Posts and Telecommunications (BUPT). + CVE-2026-54441 + * Ensure 'dtls_srtp_info' field from 'mbedtls_ssl_context' + is properly zeroized when mbedtls_ssl_session_reset() is called. This + could cause incorrect DTLS-SRTP parameter inheritance for applications + reusing an SSL context. + Reported by jjfz123. CVE-2026-50585. + * Fix a bug where mbedtls_ssl_read() and mbedtls_ssl_write() could return + 1 instead of an error code if the random generator failed when a server + called these functions before the end of a TLS 1.3 handshake. + Reported by Mohammad Seet (mhdsait101). CVE-2026-40294 + * Fix TLS 1.3 clients to reject a HelloRetryRequest whose selected group was + not advertised in the original ClientHello. Reported independently by + Din Asotić / Xiangdong Li, Beijing University of Posts and + Telecommunications (BUPT), and NVIDIA Project Vanessa. + CVE-2026-25832. + * Fix two bugs in the X.509 certificate parser that caused some inputs + with a malformed basicConstraints extension to be accepted. This + could have dangerous results, in particular causing some certificates + to be parsed as CA certificates when other X.509 implementations would + parse them as end-entity certificates. Reported by Mohammad Seet + (mhdsait101), Pablo Ruiz García and NVIDIA Project Vanessa. CVE-2026-49300 + +Bugfix + * Fix a TLS 1.2 regression that caused clients to reject valid + ServerKeyExchange signatures using RSA-PSS signature algorithms. + Fixes #10668. + * Fix a problem in library/alignment.h where the Zephyr Project use + a pre-defined macro '__packed' which collides with the IAR keyword + '__packed', causing the typedefs of unaligned types to remain aligned. + Fixes mbedtls issue #10334 + * Reject malformed TLS 1.3 serialized sessions instead of accepting + unterminated strings or extra trailing data. + * Reject serialized SSL contexts whose DTLS Connection ID length exceeds + the maximum supported size, instead of overflowing the internal buffer. + * Fix bug in configurations with MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED that + prevented re-use of an mbedtls_ecdh_context for static ECDH: our secret key + was wiped after its first use to compute a shared secret. + * Fixed documentation of mbedtls_ssl_set_cid(): the set CID configuration + is applied to all subsequent handshakes, not just to the next one. + * Reject malformed X.509 CSRs where the extensionRequest attribute + wrappers do not exactly contain the requested extensions. + +Changes + * X.509 certificates with a basicConstraints extension starting with an + INTEGER field are no longer accepted. According to RFC 5280, such + certificates are syntactically valid and the first field is the + pathLenConstraint value, but certificate authorities must not emit such + certificates. Mbed TLS interpreted it as a cA value, which was nonstandard + and dangerous. + = Mbed TLS 3.6.6 branch released 2026-03-31 Features diff --git a/ChangeLog.d/1583-1584-ssl-transcript-errors.txt b/ChangeLog.d/1583-1584-ssl-transcript-errors.txt deleted file mode 100644 index f259bd711e..0000000000 --- a/ChangeLog.d/1583-1584-ssl-transcript-errors.txt +++ /dev/null @@ -1,17 +0,0 @@ -Security - * Fix a bug where transcript-hash computation errors during TLS 1.2 - extended master secret calculation could be ignored instead of causing the - handshake to fail. This could allow a handshake to continue with a master - secret that was not correctly bound to the handshake transcript, - undermining the security guarantees of the extended master secret - extension. Report by Mathew Gretton-Dann. CVE-2026-50581 - * Fix a TLS 1.3 server-side error-handling bug affecting session ticket - generation. Under rare conditions, such as memory allocation failures - while computing the resumption master secret, the server could issue - invalid session tickets instead of failing the handshake. Clients - presented with such tickets would fail session resumption and fall back to - a full handshake. In deployments relying on session resumption, repeated - occurrences could increase the frequency of full handshakes and amplify - resource consumption during periods of resource exhaustion or other - transient failures. Reported by jjfz123. - CVE-2026-50640 diff --git a/ChangeLog.d/badmac_seen_or_in_hsfraglen.txt b/ChangeLog.d/badmac_seen_or_in_hsfraglen.txt deleted file mode 100644 index 430ecf6069..0000000000 --- a/ChangeLog.d/badmac_seen_or_in_hsfraglen.txt +++ /dev/null @@ -1,4 +0,0 @@ -Security - * Fix renegotiation failing and potentially causing a buffer overflow - in DTLS when badmac_limit is enabled. Reported by Haruki Oyama. - CVE-2026-50713. diff --git a/ChangeLog.d/chacha20-counter-overflow.txt b/ChangeLog.d/chacha20-counter-overflow.txt deleted file mode 100644 index dfdac507df..0000000000 --- a/ChangeLog.d/chacha20-counter-overflow.txt +++ /dev/null @@ -1,4 +0,0 @@ -Security - * Reject ChaCha20 operations that would make the 32-bit block counter wrap - around, which could otherwise reuse keystream and compromise - confidentiality. Reported by jiliang. CVE-2026-50584 diff --git a/ChangeLog.d/drop-early-data.txt b/ChangeLog.d/drop-early-data.txt deleted file mode 100644 index dc597a23f0..0000000000 --- a/ChangeLog.d/drop-early-data.txt +++ /dev/null @@ -1,7 +0,0 @@ -Security - * Fixed a TLS 1.3 record-boundary validation issue that could allow - unauthenticated plaintext data to be processed across a key change. In - servers with MBEDTLS_SSL_EARLY_DATA enabled, this could be exploited by a - man-in-the-middle attacker to cause loss of 0-RTT early data. - Reported by Ben Smyth. - CVE-2026-TODO. diff --git a/ChangeLog.d/ecdh-legacy-buffer-overflow.txt b/ChangeLog.d/ecdh-legacy-buffer-overflow.txt deleted file mode 100644 index 54deb795e1..0000000000 --- a/ChangeLog.d/ecdh-legacy-buffer-overflow.txt +++ /dev/null @@ -1,6 +0,0 @@ -Security - * Fix a possible buffer overflow in mbedtls_ecdh_calc_secret(): when the - provided output buffer is too small, sometimes (depending on the value of - the computed shared secret), the function would not return an error as it - should, but instead write past the end of the buffer. Reported by Eva - Crystal (0xiviel) from XSource Security. CVE-2026-35336. diff --git a/ChangeLog.d/ecdh-psk-integer-overflow.txt b/ChangeLog.d/ecdh-psk-integer-overflow.txt deleted file mode 100644 index 3ed448ee16..0000000000 --- a/ChangeLog.d/ecdh-psk-integer-overflow.txt +++ /dev/null @@ -1,3 +0,0 @@ -Security - * Fix a remote buffer overflow in (D)TLS with ECDHE-PSK cipher suites when - CBC is disabled. Reported by Karnakar Reddy. CVE-ID-50580 diff --git a/ChangeLog.d/ecp-modp-side-channel.txt b/ChangeLog.d/ecp-modp-side-channel.txt deleted file mode 100644 index 591abd8203..0000000000 --- a/ChangeLog.d/ecp-modp-side-channel.txt +++ /dev/null @@ -1,6 +0,0 @@ -Security - * Fix a side channel in ECC computations that allows a powerful local - attacker (typically, untrusted OS attacking a secure enclave) to fully - recover long-term secret keys. Found and reported by Alejandro Cabrera - Aldaya from Tampere University. CVE-2026-54435 - diff --git a/ChangeLog.d/fix-ecdh-context-reuse.txt b/ChangeLog.d/fix-ecdh-context-reuse.txt deleted file mode 100644 index 51b2bd0b25..0000000000 --- a/ChangeLog.d/fix-ecdh-context-reuse.txt +++ /dev/null @@ -1,4 +0,0 @@ -Bugfix - * Fix bug in configurations with MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED that - prevented re-use of an mbedtls_ecdh_context for static ECDH: our secret key - was wiped after its first use to compute a shared secret. diff --git a/ChangeLog.d/fix-info-leak-in-ssl.txt b/ChangeLog.d/fix-info-leak-in-ssl.txt deleted file mode 100644 index 2a0309fc40..0000000000 --- a/ChangeLog.d/fix-info-leak-in-ssl.txt +++ /dev/null @@ -1,6 +0,0 @@ -Security - * Fix a potential information disclosure in TLS 1.2 servers using session - tickets. If the session ticket write callback failed without setting the - lifetime output parameter, Mbed TLS could send 4 bytes of uninitialized - stack memory to the peer in the NewSessionTicket message. Fixes #1570. - Reported by James Love. CVE-2026-50586. diff --git a/ChangeLog.d/fix-tls12-rsa-pss-sigalgs.txt b/ChangeLog.d/fix-tls12-rsa-pss-sigalgs.txt deleted file mode 100644 index 34296b602e..0000000000 --- a/ChangeLog.d/fix-tls12-rsa-pss-sigalgs.txt +++ /dev/null @@ -1,4 +0,0 @@ -Bugfix - * Fix a TLS 1.2 regression that caused clients to reject valid - ServerKeyExchange signatures using RSA-PSS signature algorithms. - Fixes #10668. diff --git a/ChangeLog.d/harden-check-small-primes.txt b/ChangeLog.d/harden-check-small-primes.txt deleted file mode 100644 index 7d04841811..0000000000 --- a/ChangeLog.d/harden-check-small-primes.txt +++ /dev/null @@ -1,5 +0,0 @@ -Security - * Fix timing side channel in RSA key generation, prime generation and - primality testing, on platforms where division is not constant-time. At - this point this side channel is not known to be exploitable. Reported by - Bhargava Shastry, Ethereum Foundation. diff --git a/ChangeLog.d/iar-alignment-fix.txt b/ChangeLog.d/iar-alignment-fix.txt deleted file mode 100644 index dde839f16f..0000000000 --- a/ChangeLog.d/iar-alignment-fix.txt +++ /dev/null @@ -1,6 +0,0 @@ -Bugfix - * Fix a problem in library/alignment.h where the Zephyr Project use - a pre-defined macro '__packed' which collides with the IAR keyword - '__packed', causing the typedefs of unaligned types to remain aligned. - Fixes mbedtls issue #10334 - diff --git a/ChangeLog.d/mbedtls_pk_ecc_set_pubkey.txt b/ChangeLog.d/mbedtls_pk_ecc_set_pubkey.txt deleted file mode 100644 index 56020af2f7..0000000000 --- a/ChangeLog.d/mbedtls_pk_ecc_set_pubkey.txt +++ /dev/null @@ -1,4 +0,0 @@ -Security - * Fix a 1-byte buffer overread when parsing a malformed ECC public key - in the PK module. CVE-2026-50583 - diff --git a/ChangeLog.d/mbedtls_ssl_set_cid-documentation.txt b/ChangeLog.d/mbedtls_ssl_set_cid-documentation.txt deleted file mode 100644 index 1ad970fdfb..0000000000 --- a/ChangeLog.d/mbedtls_ssl_set_cid-documentation.txt +++ /dev/null @@ -1,3 +0,0 @@ -Bugfix - * Fixed documentation of mbedtls_ssl_set_cid(): the set CID configuration - is applied to all subsequent handshakes, not just to the next one. diff --git a/ChangeLog.d/oob-key-exchange-restricted.txt b/ChangeLog.d/oob-key-exchange-restricted.txt deleted file mode 100644 index 2e48ce0fec..0000000000 --- a/ChangeLog.d/oob-key-exchange-restricted.txt +++ /dev/null @@ -1,4 +0,0 @@ -Security - * Fix an out-of-bounds read when parsing TLS 1.2 ECJPAKE ServerKeyExchange - messages. Reported-by Biniam Demissie. - CVE-2026-50588 diff --git a/ChangeLog.d/pkcs-free-stale-pointers.txt b/ChangeLog.d/pkcs-free-stale-pointers.txt deleted file mode 100644 index 2c29fed5ef..0000000000 --- a/ChangeLog.d/pkcs-free-stale-pointers.txt +++ /dev/null @@ -1,6 +0,0 @@ -Security - * Fix a use-after-free/double-free risk in mbedtls_pkcs7_free() when reusing - an mbedtls_pkcs7 context across parse -> free -> parse -> free cycles. The - function now resets the context after freeing it, ensuring stale - signed_data.signers.next pointers cannot be walked by a later free - operation. CVE-2026-50579 diff --git a/ChangeLog.d/pkcs7-reject-weak-hashes.txt b/ChangeLog.d/pkcs7-reject-weak-hashes.txt deleted file mode 100644 index ce3f295db1..0000000000 --- a/ChangeLog.d/pkcs7-reject-weak-hashes.txt +++ /dev/null @@ -1,9 +0,0 @@ -Security - * PKCS7 now rejects weak hash algorithms (RIPEMD160, MD5, SHA-1, SHA-224, - SHA3-224) on signature verification. The new configuration option - MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES allows to keep using weak hash - algorithms in PKCS7 for backward compatibility purposes. - -Features - * SHA3-256, SHA3-384 and SHA3-512 are now accepted in the default X.509 - certificate profile. diff --git a/ChangeLog.d/rsa-padding.txt b/ChangeLog.d/rsa-padding.txt deleted file mode 100644 index 3580a2bcf2..0000000000 --- a/ChangeLog.d/rsa-padding.txt +++ /dev/null @@ -1,8 +0,0 @@ -Security - * Fix a side channel in RSA PKCS#1 v1.5 decryption: error handling in the - library would reveal through timing the difference between success, - invalid padding, or output too large for buffer, giving rise to a - Bleichenbacher attack. Note that while the library now handles sensitive - errors in constant-time, RSA PKCS#1 v1.5 decryption remains inherently - dangerous, should be avoided when possible, and otherwise requires great - care in application code. Found by zhengg. CVE-2026-50587 diff --git a/ChangeLog.d/security-advice.txt b/ChangeLog.d/security-advice.txt deleted file mode 100644 index 1f7677a882..0000000000 --- a/ChangeLog.d/security-advice.txt +++ /dev/null @@ -1,2 +0,0 @@ -Security - * Added advice about compiler options in SECURITY.md. diff --git a/ChangeLog.d/security-issue1569.txt b/ChangeLog.d/security-issue1569.txt deleted file mode 100644 index c9e285b80e..0000000000 --- a/ChangeLog.d/security-issue1569.txt +++ /dev/null @@ -1,7 +0,0 @@ -Security - * Improved documentation of mbedtls_ssl_conf_sig_algs() to emphasize that - this function only sets signature algorithms that are enforced during - TLS key exchange and not on certificate verification. Reported by - Xiangdong Li, Beijing University of Posts and Telecommunications (BUPT). - CVE-2026-54441 - diff --git a/ChangeLog.d/security1585.txt b/ChangeLog.d/security1585.txt deleted file mode 100644 index 5aa1bc81f1..0000000000 --- a/ChangeLog.d/security1585.txt +++ /dev/null @@ -1,6 +0,0 @@ -Security - * Ensure 'dtls_srtp_info' field from 'mbedtls_ssl_context' - is properly zeroized when mbedtls_ssl_session_reset() is called. This - could cause incorrect DTLS-SRTP parameter inheritance for applications - reusing an SSL context. - Reported by jjfz123. CVE-2026-50585. diff --git a/ChangeLog.d/serialized-data-load-hardening.txt b/ChangeLog.d/serialized-data-load-hardening.txt deleted file mode 100644 index e068988dac..0000000000 --- a/ChangeLog.d/serialized-data-load-hardening.txt +++ /dev/null @@ -1,5 +0,0 @@ -Bugfix - * Reject malformed TLS 1.3 serialized sessions instead of accepting - unterminated strings or extra trailing data. - * Reject serialized SSL contexts whose DTLS Connection ID length exceeds - the maximum supported size, instead of overflowing the internal buffer. diff --git a/ChangeLog.d/ssl_tls13_prepare_new_session_ticket-psa_get_random.txt b/ChangeLog.d/ssl_tls13_prepare_new_session_ticket-psa_get_random.txt deleted file mode 100644 index b020546b12..0000000000 --- a/ChangeLog.d/ssl_tls13_prepare_new_session_ticket-psa_get_random.txt +++ /dev/null @@ -1,5 +0,0 @@ -Security - * Fix a bug where mbedtls_ssl_read() and mbedtls_ssl_write() could return - 1 instead of an error code if the random generator failed when a server - called these functions before the end of a TLS 1.3 handshake. - Reported by Mohammad Seet (mhdsait101). CVE-2026-40294 diff --git a/ChangeLog.d/tls13-hrr-selected-group.txt b/ChangeLog.d/tls13-hrr-selected-group.txt deleted file mode 100644 index 4c338480f6..0000000000 --- a/ChangeLog.d/tls13-hrr-selected-group.txt +++ /dev/null @@ -1,7 +0,0 @@ -Security - * Fix TLS 1.3 clients to reject a HelloRetryRequest whose selected group was - not advertised in the original ClientHello. Reported independently by - Din Asotić / Xiangdong Li, Beijing University of Posts and - Telecommunications (BUPT), and NVIDIA Project Vanessa. - CVE-2026-25832. - diff --git a/ChangeLog.d/x509-crt-parse-basicConstraints.txt b/ChangeLog.d/x509-crt-parse-basicConstraints.txt deleted file mode 100644 index 251dc8f0fd..0000000000 --- a/ChangeLog.d/x509-crt-parse-basicConstraints.txt +++ /dev/null @@ -1,15 +0,0 @@ -Security - * Fix two bugs in the X.509 certificate parser that caused some inputs - with a malformed basicConstraints extension to be accepted. This - could have dangerous results, in particular causing some certificates - to be parsed as CA certificates when other X.509 implementations would - parse them as end-entity certificates. Reported by Mohammad Seet - (mhdsait101), Pablo Ruiz García and NVIDIA Project Vanessa. CVE-2026-49300 - -Changes - * X.509 certificates with a basicConstraints extension starting with an - INTEGER field are no longer accepted. According to RFC 5280, such - certificates are syntactically valid and the first field is the - pathLenConstraint value, but certificate authorities must not emit such - certificates. Mbed TLS interpreted it as a cA value, which was nonstandard - and dangerous. diff --git a/ChangeLog.d/x509-csr-extension-request-bounds.txt b/ChangeLog.d/x509-csr-extension-request-bounds.txt deleted file mode 100644 index dfc706703c..0000000000 --- a/ChangeLog.d/x509-csr-extension-request-bounds.txt +++ /dev/null @@ -1,3 +0,0 @@ -Bugfix - * Reject malformed X.509 CSRs where the extensionRequest attribute - wrappers do not exactly contain the requested extensions.