From 8d0f61723ee5f1424008fb8d980a0f6d848ac7b9 Mon Sep 17 00:00:00 2001 From: Naveed Date: Fri, 23 Oct 2026 20:38:13 +0530 Subject: [PATCH] Ignore TLS 1.3 tickets in the TLS 1.2 session_ticket extension ssl_parse_session_ticket_ext() accepted any ticket that the ticket callback could parse, including one issued for a TLS 1.3 session. Such a session has no TLS 1.2 master secret, so the server resumed with an all-zero master secret. Ignore the ticket unless it is for TLS 1.2, as the TLS 1.3 server already does for TLS 1.2 tickets. Signed-off-by: Naveed --- ChangeLog.d/tls12-reject-tls13-ticket.txt | 8 ++++++++ library/ssl_tls12_server.c | 10 ++++++++++ 2 files changed, 18 insertions(+) create mode 100644 ChangeLog.d/tls12-reject-tls13-ticket.txt diff --git a/ChangeLog.d/tls12-reject-tls13-ticket.txt b/ChangeLog.d/tls12-reject-tls13-ticket.txt new file mode 100644 index 0000000000..c31207c0ab --- /dev/null +++ b/ChangeLog.d/tls12-reject-tls13-ticket.txt @@ -0,0 +1,8 @@ +Security + * Fix a TLS 1.2 server accepting a session ticket that was issued for a + TLS 1.3 session. The session was resumed with an all-zero master secret, + so anyone holding the ticket could complete the abbreviated handshake and + derive the connection keys from public handshake values. TLS 1.3 tickets + appear in clear in the pre_shared_key extension of a TLS 1.3 resumption + ClientHello. This affects servers that enable both TLS 1.2 and TLS 1.3 + and session tickets. diff --git a/library/ssl_tls12_server.c b/library/ssl_tls12_server.c index 598f8b946b..cded600873 100644 --- a/library/ssl_tls12_server.c +++ b/library/ssl_tls12_server.c @@ -480,6 +480,16 @@ static int ssl_parse_session_ticket_ext(mbedtls_ssl_context *ssl, return 0; } + /* + * A ticket issued for a TLS 1.3 session has no TLS 1.2 master secret, + * so it must not be used to resume a TLS 1.2 session. + */ + if (session.tls_version != MBEDTLS_SSL_VERSION_TLS1_2) { + mbedtls_ssl_session_free(&session); + MBEDTLS_SSL_DEBUG_MSG(3, ("ticket TLS version is not 1.2")); + return 0; + } + /* * Keep the session ID sent by the client, since we MUST send it back to * inform them we're accepting the ticket (RFC 5077 section 3.4)