coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-10-28 18:07:34 +08:00
Code Issues Packages Projects Releases Wiki Activity

Ignore TLS 1.3 tickets in the TLS 1.2 session_ticket extension

Browse Source 
ssl_parse_session_ticket_ext() accepted any ticket that the ticket
callback could parse, including one issued for a TLS 1.3 session. Such
a session has no TLS 1.2 master secret, so the server resumed with an
all-zero master secret. Ignore the ticket unless it is for TLS 1.2, as
the TLS 1.3 server already does for TLS 1.2 tickets.

Signed-off-by: Naveed <naveed@bugqore.com>
This commit is contained in:
Naveed 2026-10-23 20:38:13 +05:30
parent d71272700a
commit 8d0f61723e
2 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
ChangeLog.d/tls12-reject-tls13-ticket.txt Normal file
View File

@ -0,0 +1,8 @@
Security
* Fix a TLS 1.2 server accepting a session ticket that was issued for a
TLS 1.3 session. The session was resumed with an all-zero master secret,
so anyone holding the ticket could complete the abbreviated handshake and
derive the connection keys from public handshake values. TLS 1.3 tickets
appear in clear in the pre_shared_key extension of a TLS 1.3 resumption
ClientHello. This affects servers that enable both TLS 1.2 and TLS 1.3
and session tickets.

10
library/ssl_tls12_server.c
View File

@ -480,6 +480,16 @@ static int ssl_parse_session_ticket_ext(mbedtls_ssl_context *ssl,
return 0;
}
/*
* A ticket issued for a TLS 1.3 session has no TLS 1.2 master secret,
* so it must not be used to resume a TLS 1.2 session.
*/
if (session.tls_version != MBEDTLS_SSL_VERSION_TLS1_2) {
mbedtls_ssl_session_free(&session);
MBEDTLS_SSL_DEBUG_MSG(3, ("ticket TLS version is not 1.2"));
return 0;
}
/*
* Keep the session ID sent by the client, since we MUST send it back to
* inform them we're accepting the ticket (RFC 5077 section 3.4)