coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-07-30 16:26:33 +08:00
Code Issues Packages Projects Releases Wiki Activity
34,642 Commits 183 Branches 286 Tags Multiple Licenses 215 MiB
Commit Graph

1821 Commits

Author SHA1 Message Date
Ben Taylor
fa003af204 Update ChangeLog with CVE number 
Co-authored-by: Ronald Cron <ronald.cron@arm.com>
Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com>
 2026-06-24 09:33:33 +01:00
Ben Taylor
75bdaa35c3 Update ChangeLog to add CVE 
Co-authored-by: Gilles Peskine <gilles.peskine@arm.com>
Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com>
 2026-06-24 09:33:33 +01:00
Ben Taylor
86b94d411c Improve ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 09:33:33 +01:00
Ben Taylor
835226c59a Update ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 09:33:33 +01:00
Ben Taylor
d32397563e Fix reporters in ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 09:33:33 +01:00
Ben Taylor
f487bd2e07 Tidy up ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 09:33:33 +01:00
Ben Taylor
795eb3ee95 Add Reported by to ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 09:33:33 +01:00
Ben Taylor
ceaa75b899 Add security impact 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 09:33:32 +01:00
Ben Taylor
b35f870331 Update ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 09:33:32 +01:00
Ben Taylor
c7f07e9288 Add ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 09:33:32 +01:00
Gilles Peskine
98e4a7b02a
Merge pull request #1595 from bjwtaylor/info-leak-in-ssl_write_new_session_ticket 
Info leak in ssl write new session ticket
 2026-06-24 09:42:13 +02:00
Gilles Peskine
8300fd0a65
Merge pull request #1638 from valeriosetti/issue1598 
[development] PKCS7 accepts weak hashes
 2026-06-23 16:40:47 +02:00
Ronald Cron
27fcc8e3a0
Merge pull request #1582 from bjwtaylor/pkcs-free-stale-pointers 
Add fix for stale pointer after mbedtls_pkcs7_free
 2026-06-22 17:54:17 +02:00
Valerio Setti
f065e47b18 changelog: update documentation for PKCS7 changes 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-22 11:39:49 +02:00
Valerio Setti
394d8e6a6f changelog: add note for PKCS7 rejecting weak hash algorithms 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-22 11:39:49 +02:00
Gilles Peskine
55bd327bad
Merge pull request #1630 from gilles-peskine-arm/basic-constaints-sequence-check-dev 
Fix CA bit forgery through invalid basicConstraints
 2026-06-18 15:36:41 +02:00
Gilles Peskine
e31c644041 Credit independent report 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-06-16 19:34:32 +02:00
Gilles Peskine
86b620ace3
Merge pull request #1586 from bjwtaylor/ECDHE-PSK-integer-overflow 
Ecdhe psk integer overflow fix
 2026-06-16 11:49:54 +02:00
Ronald Cron
9b2a6cc914
Merge pull request #1663 from minosgalanakis/public-sync/development-14062026 
[Sync] Merge development into development-restricted
 2026-06-16 08:44:06 +02:00
Ronald Cron
8efcd8d700
Merge pull request #1603 from bjwtaylor/oob-key-exchange-restricted 
Add fix for OOB key exchange error
 2026-06-15 22:42:08 +02:00
Ben Taylor
a798b5804e Add CVE ID to ChangeLog 
Co-authored-by: Gilles Peskine <gilles.peskine@arm.com>
Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com>
 2026-06-15 13:27:02 +01:00
Ben Taylor
74555884cc Remove whitespace in ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-15 13:27:02 +01:00
Ben Taylor
351419f1ff Correct changelog style 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-15 13:27:02 +01:00
Ben Taylor
6443590448 Update ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-15 13:27:02 +01:00
Ben Taylor
4e797c14e0 Update ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-15 13:27:02 +01:00
Ben Taylor
e9ec4ce3ca Add ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-15 13:27:02 +01:00
Minos Galanakis
c508351e39 Merge remote-tracking branch 'public/development' into sync/development-14062026 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-14 19:32:58 +01:00
Ben Taylor
1aa1254546 Fix style issue 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-10 14:15:48 +01:00
Ronald Cron
1070ab8dd7
Merge pull request #1563 from minosgalanakis/security/mlfbyt4c_tls13_policy_bypass 
TLS1.3 client HRR policy bypass[ARM-MLFBYT4C]
 2026-06-10 13:04:24 +02:00
Ben Taylor
cecb4c2162 Correct ChangeLog style 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-10 08:21:05 +01:00
Ben Taylor
911b9b67db
Add CVE ID to ChangeLog 
Co-authored-by: Gilles Peskine <gilles.peskine@arm.com>
Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com>
 2026-06-08 15:48:14 +01:00
Ben Taylor
0c62b498bd Add ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-08 15:46:00 +01:00
Ben Taylor
5e04a32840
Add CVE to ChangeLog 
Co-authored-by: Ronald Cron <ronald.cron@arm.com>
Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com>
 2026-06-08 15:13:37 +01:00
Ben Taylor
4b32430d3c
Improve the wording of the ChangeLog 
Co-authored-by: Ronald Cron <ronald.cron@arm.com>
Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com>
 2026-06-08 15:13:02 +01:00
Gilles Peskine
e94a7a2d22 Add CVE-ID 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-06-05 11:35:46 +02:00
Gilles Peskine
ca89089968 Add attribution for the second bug 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-06-05 11:35:46 +02:00
Gilles Peskine
045cede1b8 basicConstraints with leading INTEGER field: document the behavior change 
Announce the security fix together with the overflow fix, since the two bugs
are pretty much indistinguishable from a black-box perspective, despite
being due to independent problems in the code.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-06-05 11:35:46 +02:00
Gilles Peskine
cc794d8501 Tighten CSR extensionRequest bounds 
Don't allow parts of a compound (SEQUENCE or SET) to go beyond the
containing compound.

The inline CSR regression test is derived from the existing "X509 CSR
ASN.1 (OK)" DER test vector. In the extensionRequest attribute, the original
well-formed fragment is:

    a029 3027 06092a864886f70d01090e 311a 3018 ...

where 31 1a is the SET containing the Extensions sequence and 30 18 is the
contained Extensions sequence. The malformed test changes only the SET
length byte, from 1a to 19:

    a029 3027 06092a864886f70d01090e 3119 3018 ...

The attribute SEQUENCE length and the inner Extensions sequence length are
left unchanged. This makes the SET one byte too short for its containing
attribute, so the parser must reject it with
MBEDTLS_ERR_ASN1_LENGTH_MISMATCH instead of parsing the trailing byte as
data outside the SET.

There is no known security impact, just some risk reduction.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-06-05 11:35:38 +02:00
Ben Taylor
a7c0d83354 Add improvements to ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-05 10:22:49 +01:00
Ben Taylor
ab2a7d5a34 Add reported by and CVE placeholder 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-04 14:22:38 +01:00
Ben Taylor
0501e447cc Correct style of ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-04 14:22:38 +01:00
Ben Taylor
c058818451 Improve ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-04 14:22:38 +01:00
Ben Taylor
e71e49e634 Add ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-04 14:22:38 +01:00
Ronald Cron
5ca2218a28
Merge pull request #1589 from gilles-peskine-arm/ssl_tls13_prepare_new_session_ticket-psa_get_random-4.1 
Fix ssl_tls13_prepare_new_session_ticket returning 1 on an RNG failure
 2026-05-29 16:20:27 +02:00
Gilles Peskine
b05434c1b1 Improve changelog wording 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-05-28 16:32:35 +02:00
Gilles Peskine
6c8ae1ea48 Fix lax basicConstraints parsing 
When parsing the basicConstraints extension, reject junk after the SEQUENCE
inside the extension (which is probably benign), and reject a SEQUENCE that
extends beyond the extension (could be very dangerous).

Add a non-regression test where a certificate that is technically malformed,
but accepted as a leaf certificate by OpenSSL and other X.509
implementations, to be accepted as a CA certificate by Mbed TLS.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-05-26 21:07:09 +02:00
Janos Follath
545d1b77a2
Merge pull request #10741 from valeriosetti/fix-mbedtls_config 
mbedtls_config.c missing mbedtls_platform_requirements.h
 2026-05-26 09:24:54 +00:00
Valerio Setti
147ad72669 changelog: fix typos 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-05-19 12:37:30 +02:00
Valerio Setti
c53e78796a changelog: add note about issue 1569 resolution 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-05-18 11:08:23 +02:00
Ben Taylor
ea9dc9c396 Add ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-05-13 11:16:49 +01:00