From 08e3e3f81e6c5703c3afcbfcb47c600a2b10afcb Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Mon, 11 May 2026 15:22:09 +0100 Subject: [PATCH 1/7] Add fix for OOB key exchange error Signed-off-by: Ben Taylor --- library/ssl_tls12_client.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/library/ssl_tls12_client.c b/library/ssl_tls12_client.c index a0170d51f6..d32fea18c1 100644 --- a/library/ssl_tls12_client.c +++ b/library/ssl_tls12_client.c @@ -1885,6 +1885,8 @@ start_processing: * However since we only support secp256r1 for now, we check only * that TLS ID here */ + MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 3); + uint16_t read_tls_id = MBEDTLS_GET_UINT16_BE(p, 1); uint16_t exp_tls_id = mbedtls_ssl_get_tls_id_from_ecp_group_id( MBEDTLS_ECP_DP_SECP256R1); From ea9dc9c396a883aa08851eda9381a42ab6d0f9e4 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Tue, 12 May 2026 14:41:06 +0100 Subject: [PATCH 2/7] Add ChangeLog Signed-off-by: Ben Taylor --- ChangeLog.d/oob-key-exchange-restricted.txt | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 ChangeLog.d/oob-key-exchange-restricted.txt diff --git a/ChangeLog.d/oob-key-exchange-restricted.txt b/ChangeLog.d/oob-key-exchange-restricted.txt new file mode 100644 index 0000000000..794e294272 --- /dev/null +++ b/ChangeLog.d/oob-key-exchange-restricted.txt @@ -0,0 +1,3 @@ +Bugfix + * Fix an out-of-bounds read in TLS 1.2 ECJPAKE ServerKeyExchange parsing. + Fixes #1590. From a7c0d833547449868f12e40d22bc9e6cb6b24ec5 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Fri, 5 Jun 2026 10:22:49 +0100 Subject: [PATCH 3/7] Add improvements to ChangeLog Signed-off-by: Ben Taylor --- ChangeLog.d/oob-key-exchange-restricted.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ChangeLog.d/oob-key-exchange-restricted.txt b/ChangeLog.d/oob-key-exchange-restricted.txt index 794e294272..a0e698c077 100644 --- a/ChangeLog.d/oob-key-exchange-restricted.txt +++ b/ChangeLog.d/oob-key-exchange-restricted.txt @@ -1,3 +1,3 @@ -Bugfix +Security * Fix an out-of-bounds read in TLS 1.2 ECJPAKE ServerKeyExchange parsing. - Fixes #1590. + Reported-by Biniam Demissie From 4b32430d3c0123654ad6f6fbb208e955c24579ec Mon Sep 17 00:00:00 2001 From: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com> Date: Mon, 8 Jun 2026 15:13:02 +0100 Subject: [PATCH 4/7] Improve the wording of the ChangeLog Co-authored-by: Ronald Cron Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com> --- ChangeLog.d/oob-key-exchange-restricted.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog.d/oob-key-exchange-restricted.txt b/ChangeLog.d/oob-key-exchange-restricted.txt index a0e698c077..a4bfe738b2 100644 --- a/ChangeLog.d/oob-key-exchange-restricted.txt +++ b/ChangeLog.d/oob-key-exchange-restricted.txt @@ -1,3 +1,3 @@ Security - * Fix an out-of-bounds read in TLS 1.2 ECJPAKE ServerKeyExchange parsing. + * Fix an out-of-bounds read when parsing TLS 1.2 ECJPAKE ServerKeyExchange messages. Reported-by Biniam Demissie From 5e04a328403e760e821fe4365bad02a14d6f8f22 Mon Sep 17 00:00:00 2001 From: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com> Date: Mon, 8 Jun 2026 15:13:37 +0100 Subject: [PATCH 5/7] Add CVE to ChangeLog Co-authored-by: Ronald Cron Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com> --- ChangeLog.d/oob-key-exchange-restricted.txt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ChangeLog.d/oob-key-exchange-restricted.txt b/ChangeLog.d/oob-key-exchange-restricted.txt index a4bfe738b2..62e613648b 100644 --- a/ChangeLog.d/oob-key-exchange-restricted.txt +++ b/ChangeLog.d/oob-key-exchange-restricted.txt @@ -1,3 +1,4 @@ Security * Fix an out-of-bounds read when parsing TLS 1.2 ECJPAKE ServerKeyExchange messages. - Reported-by Biniam Demissie + Reported-by Biniam Demissie. + CVE-2026-50588 From cecb4c21628d62290b4d1498ebd43ea8ee75fa53 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Wed, 10 Jun 2026 08:21:05 +0100 Subject: [PATCH 6/7] Correct ChangeLog style Signed-off-by: Ben Taylor --- ChangeLog.d/oob-key-exchange-restricted.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ChangeLog.d/oob-key-exchange-restricted.txt b/ChangeLog.d/oob-key-exchange-restricted.txt index 62e613648b..6a250644b9 100644 --- a/ChangeLog.d/oob-key-exchange-restricted.txt +++ b/ChangeLog.d/oob-key-exchange-restricted.txt @@ -1,4 +1,4 @@ Security - * Fix an out-of-bounds read when parsing TLS 1.2 ECJPAKE ServerKeyExchange messages. - Reported-by Biniam Demissie. + * Fix an out-of-bounds read when parsing TLS 1.2 ECJPAKE ServerKeyExchange + messages. Reported-by Biniam Demissie. CVE-2026-50588 From 1aa125454601ef3492c285d2122518ac3fa3b6c2 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Wed, 10 Jun 2026 14:15:48 +0100 Subject: [PATCH 7/7] Fix style issue Signed-off-by: Ben Taylor --- ChangeLog.d/oob-key-exchange-restricted.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog.d/oob-key-exchange-restricted.txt b/ChangeLog.d/oob-key-exchange-restricted.txt index 6a250644b9..2e48ce0fec 100644 --- a/ChangeLog.d/oob-key-exchange-restricted.txt +++ b/ChangeLog.d/oob-key-exchange-restricted.txt @@ -1,4 +1,4 @@ Security - * Fix an out-of-bounds read when parsing TLS 1.2 ECJPAKE ServerKeyExchange + * Fix an out-of-bounds read when parsing TLS 1.2 ECJPAKE ServerKeyExchange messages. Reported-by Biniam Demissie. CVE-2026-50588