coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-07-30 16:26:33 +08:00
Code Issues Packages Projects Releases Wiki Activity
34,579 Commits 183 Branches 286 Tags Multiple Licenses 215 MiB
Commit Graph

1808 Commits

Author SHA1 Message Date
Minos Galanakis
567a3a443d Added attribution 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-23 10:52:37 +01:00
Minos Galanakis
de8a0d3fdb Added CVE 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-22 22:29:15 +01:00
Ronald Cron
27fcc8e3a0
Merge pull request #1582 from bjwtaylor/pkcs-free-stale-pointers 
Add fix for stale pointer after mbedtls_pkcs7_free
 2026-06-22 17:54:17 +02:00
Gilles Peskine
55bd327bad
Merge pull request #1630 from gilles-peskine-arm/basic-constaints-sequence-check-dev 
Fix CA bit forgery through invalid basicConstraints
 2026-06-18 15:36:41 +02:00
Gilles Peskine
e31c644041 Credit independent report 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-06-16 19:34:32 +02:00
Gilles Peskine
86b620ace3
Merge pull request #1586 from bjwtaylor/ECDHE-PSK-integer-overflow 
Ecdhe psk integer overflow fix
 2026-06-16 11:49:54 +02:00
Ronald Cron
9b2a6cc914
Merge pull request #1663 from minosgalanakis/public-sync/development-14062026 
[Sync] Merge development into development-restricted
 2026-06-16 08:44:06 +02:00
Ronald Cron
8efcd8d700
Merge pull request #1603 from bjwtaylor/oob-key-exchange-restricted 
Add fix for OOB key exchange error
 2026-06-15 22:42:08 +02:00
Ben Taylor
a798b5804e Add CVE ID to ChangeLog 
Co-authored-by: Gilles Peskine <gilles.peskine@arm.com>
Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com>
 2026-06-15 13:27:02 +01:00
Ben Taylor
74555884cc Remove whitespace in ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-15 13:27:02 +01:00
Ben Taylor
351419f1ff Correct changelog style 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-15 13:27:02 +01:00
Ben Taylor
6443590448 Update ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-15 13:27:02 +01:00
Ben Taylor
4e797c14e0 Update ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-15 13:27:02 +01:00
Ben Taylor
e9ec4ce3ca Add ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-15 13:27:02 +01:00
Minos Galanakis
c508351e39 Merge remote-tracking branch 'public/development' into sync/development-14062026 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-14 19:32:58 +01:00
Ben Taylor
1aa1254546 Fix style issue 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-10 14:15:48 +01:00
Ronald Cron
1070ab8dd7
Merge pull request #1563 from minosgalanakis/security/mlfbyt4c_tls13_policy_bypass 
TLS1.3 client HRR policy bypass[ARM-MLFBYT4C]
 2026-06-10 13:04:24 +02:00
Ben Taylor
cecb4c2162 Correct ChangeLog style 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-10 08:21:05 +01:00
Ben Taylor
911b9b67db
Add CVE ID to ChangeLog 
Co-authored-by: Gilles Peskine <gilles.peskine@arm.com>
Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com>
 2026-06-08 15:48:14 +01:00
Ben Taylor
5e04a32840
Add CVE to ChangeLog 
Co-authored-by: Ronald Cron <ronald.cron@arm.com>
Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com>
 2026-06-08 15:13:37 +01:00
Ben Taylor
4b32430d3c
Improve the wording of the ChangeLog 
Co-authored-by: Ronald Cron <ronald.cron@arm.com>
Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com>
 2026-06-08 15:13:02 +01:00
Gilles Peskine
e94a7a2d22 Add CVE-ID 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-06-05 11:35:46 +02:00
Gilles Peskine
ca89089968 Add attribution for the second bug 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-06-05 11:35:46 +02:00
Gilles Peskine
045cede1b8 basicConstraints with leading INTEGER field: document the behavior change 
Announce the security fix together with the overflow fix, since the two bugs
are pretty much indistinguishable from a black-box perspective, despite
being due to independent problems in the code.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-06-05 11:35:46 +02:00
Gilles Peskine
cc794d8501 Tighten CSR extensionRequest bounds 
Don't allow parts of a compound (SEQUENCE or SET) to go beyond the
containing compound.

The inline CSR regression test is derived from the existing "X509 CSR
ASN.1 (OK)" DER test vector. In the extensionRequest attribute, the original
well-formed fragment is:

    a029 3027 06092a864886f70d01090e 311a 3018 ...

where 31 1a is the SET containing the Extensions sequence and 30 18 is the
contained Extensions sequence. The malformed test changes only the SET
length byte, from 1a to 19:

    a029 3027 06092a864886f70d01090e 3119 3018 ...

The attribute SEQUENCE length and the inner Extensions sequence length are
left unchanged. This makes the SET one byte too short for its containing
attribute, so the parser must reject it with
MBEDTLS_ERR_ASN1_LENGTH_MISMATCH instead of parsing the trailing byte as
data outside the SET.

There is no known security impact, just some risk reduction.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-06-05 11:35:38 +02:00
Ben Taylor
a7c0d83354 Add improvements to ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-05 10:22:49 +01:00
Ben Taylor
ab2a7d5a34 Add reported by and CVE placeholder 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-04 14:22:38 +01:00
Ben Taylor
0501e447cc Correct style of ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-04 14:22:38 +01:00
Ben Taylor
c058818451 Improve ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-04 14:22:38 +01:00
Ben Taylor
e71e49e634 Add ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-04 14:22:38 +01:00
Ronald Cron
5ca2218a28
Merge pull request #1589 from gilles-peskine-arm/ssl_tls13_prepare_new_session_ticket-psa_get_random-4.1 
Fix ssl_tls13_prepare_new_session_ticket returning 1 on an RNG failure
 2026-05-29 16:20:27 +02:00
Gilles Peskine
b05434c1b1 Improve changelog wording 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-05-28 16:32:35 +02:00
Gilles Peskine
6c8ae1ea48 Fix lax basicConstraints parsing 
When parsing the basicConstraints extension, reject junk after the SEQUENCE
inside the extension (which is probably benign), and reject a SEQUENCE that
extends beyond the extension (could be very dangerous).

Add a non-regression test where a certificate that is technically malformed,
but accepted as a leaf certificate by OpenSSL and other X.509
implementations, to be accepted as a CA certificate by Mbed TLS.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-05-26 21:07:09 +02:00
Janos Follath
545d1b77a2
Merge pull request #10741 from valeriosetti/fix-mbedtls_config 
mbedtls_config.c missing mbedtls_platform_requirements.h
 2026-05-26 09:24:54 +00:00
Valerio Setti
147ad72669 changelog: fix typos 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-05-19 12:37:30 +02:00
Valerio Setti
c53e78796a changelog: add note about issue 1569 resolution 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-05-18 11:08:23 +02:00
Ben Taylor
ea9dc9c396 Add ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-05-13 11:16:49 +01:00
Minos Galanakis
5936ba523d Added ChangeLog 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-05-12 14:59:18 +01:00
Gilles Peskine
465d6e9669 Fix ssl_tls13_prepare_new_session_ticket returning 1 on an RNG failure 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-05-04 18:44:05 +02:00
Valerio Setti
cd8b3878c5 changelog: add note about fix of issue 10740 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2026-04-29 17:05:51 +02:00
minosgalanakis
d12fbb991c
Merge pull request #10695 from valord577/patch-1 
Fix build warning/error using llvm-mingw
 2026-04-29 14:52:00 +00:00
Gilles Peskine
a314ada082
Merge pull request #10631 from yiwu0b11/destdir_install_env_support 
Support DESTDIR for install and add build-system test
 2026-04-29 14:37:29 +00:00
valord577
68319cbc80 update ChangeLog 
Signed-off-by: valord577 <valord577@gmail.com>
 2026-04-22 11:05:04 +08:00
valord577
e022733f9f
Merge branch 'Mbed-TLS:development' into patch-1 2026-04-22 10:41:51 +08:00
valord577
37b81f13c7 add ChangeLog 
Signed-off-by: valord577 <valord577@gmail.com>
 2026-04-16 15:17:32 +08:00
Viktor Sokolovskiy
2168fe9cda ssl: narrow TLS 1.2 RSA-PSS handling and add interop coverage 
Signed-off-by: Viktor Sokolovskiy <maokaman@gmail.com>
 2026-04-16 04:36:48 +03:00
Yi Wu
6fb557c31a ChangeLog fix 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-04-13 15:00:44 +01:00
Yi Wu
15be9e9048 ChangeLog fixes 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-04-13 12:12:24 +01:00
Yi Wu
f14f28ce75 ChangeLog padding space fix 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-04-10 10:27:09 +01:00
Viktor Sokolovskiy
f75c033ead ssl: add TLS 1.2 RSA-PSS regression coverage 
Signed-off-by: Viktor Sokolovskiy <maokaman@gmail.com>
 2026-04-07 20:20:09 +03:00