coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-07-30 16:26:33 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1603 from bjwtaylor/oob-key-exchange-restricted

Browse Source 
Add fix for OOB key exchange error
This commit is contained in:
Ronald Cron 2026-06-15 22:42:08 +02:00 committed by GitHub
commit 8efcd8d700
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
ChangeLog.d/oob-key-exchange-restricted.txt Normal file
View File

@ -0,0 +1,4 @@
Security
* Fix an out-of-bounds read when parsing TLS 1.2 ECJPAKE ServerKeyExchange
messages. Reported-by Biniam Demissie.
CVE-2026-50588

2
library/ssl_tls12_client.c
View File

@ -1931,6 +1931,8 @@ start_processing:
* However since we only support secp256r1 for now, we check only
* that TLS ID here
*/
MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 3);
uint16_t read_tls_id = MBEDTLS_GET_UINT16_BE(p, 1);
uint16_t exp_tls_id = mbedtls_ssl_get_tls_id_from_ecp_group_id(
MBEDTLS_ECP_DP_SECP256R1);