coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-07-30 16:26:33 +08:00
Code Issues Packages Projects Releases Wiki Activity
34,692 Commits 183 Branches 286 Tags Multiple Licenses 215 MiB
Commit Graph

1834 Commits

Author SHA1 Message Date
Minos Galanakis
f3c2896076 Assemble ChangeLog 
./framework/scripts/assemble_changelog.py

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-29 18:12:41 +01:00
Minos Galanakis
d156cf4c02 Merge remote-tracking branch 'development-restricted' into mbedtls-4.2.0.rc 2026-06-26 22:23:37 +01:00
Ronald Cron
41a8bdf109
Merge pull request #1619 from valeriosetti/issue1585 
[development] Stale DTLS- SRTP negotiation state after session_reset() (ARM-RZ7EMQAA)
 2026-06-26 12:17:06 +02:00
Ronald Cron
3bb1c69f7e
Merge pull request #1685 from minosgalanakis/security/mlfbyt4c_tls13_policy_bypass_changelog 
Add Attribution CVE mbedtls:development-restricted
 2026-06-25 15:54:46 +02:00
Ronald Cron
e55d0b76ed Add change log 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Minos Galanakis
f722436e46 Changelog. Added attribution/CVE for 1569 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-24 14:36:00 +01:00
Valerio Setti
4b57c243bb changelog: add note for documentation fix for mbedtls_ssl_set_cid 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-24 14:30:59 +02:00
Valerio Setti
931b983159 changelog: add reset for some fields of the SSL context structure 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-24 14:30:59 +02:00
Ben Taylor
fa003af204 Update ChangeLog with CVE number 
Co-authored-by: Ronald Cron <ronald.cron@arm.com>
Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com>
 2026-06-24 09:33:33 +01:00
Ben Taylor
75bdaa35c3 Update ChangeLog to add CVE 
Co-authored-by: Gilles Peskine <gilles.peskine@arm.com>
Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com>
 2026-06-24 09:33:33 +01:00
Ben Taylor
86b94d411c Improve ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 09:33:33 +01:00
Ben Taylor
835226c59a Update ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 09:33:33 +01:00
Ben Taylor
d32397563e Fix reporters in ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 09:33:33 +01:00
Ben Taylor
f487bd2e07 Tidy up ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 09:33:33 +01:00
Ben Taylor
795eb3ee95 Add Reported by to ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 09:33:33 +01:00
Ben Taylor
ceaa75b899 Add security impact 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 09:33:32 +01:00
Ben Taylor
b35f870331 Update ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 09:33:32 +01:00
Ben Taylor
c7f07e9288 Add ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 09:33:32 +01:00
Gilles Peskine
98e4a7b02a
Merge pull request #1595 from bjwtaylor/info-leak-in-ssl_write_new_session_ticket 
Info leak in ssl write new session ticket
 2026-06-24 09:42:13 +02:00
Gilles Peskine
8300fd0a65
Merge pull request #1638 from valeriosetti/issue1598 
[development] PKCS7 accepts weak hashes
 2026-06-23 16:40:47 +02:00
Minos Galanakis
567a3a443d Added attribution 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-23 10:52:37 +01:00
Minos Galanakis
de8a0d3fdb Added CVE 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-22 22:29:15 +01:00
Ronald Cron
27fcc8e3a0
Merge pull request #1582 from bjwtaylor/pkcs-free-stale-pointers 
Add fix for stale pointer after mbedtls_pkcs7_free
 2026-06-22 17:54:17 +02:00
Valerio Setti
f065e47b18 changelog: update documentation for PKCS7 changes 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-22 11:39:49 +02:00
Valerio Setti
394d8e6a6f changelog: add note for PKCS7 rejecting weak hash algorithms 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-22 11:39:49 +02:00
Gilles Peskine
55bd327bad
Merge pull request #1630 from gilles-peskine-arm/basic-constaints-sequence-check-dev 
Fix CA bit forgery through invalid basicConstraints
 2026-06-18 15:36:41 +02:00
Ronald Cron
45ad2fc5ee
Merge pull request #10715 from Nadav0077/harden-tls13-session-load 
Harden TLS 1.3 serialized session loading
 2026-06-18 10:36:47 +00:00
Gilles Peskine
e31c644041 Credit independent report 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-06-16 19:34:32 +02:00
Gilles Peskine
86b620ace3
Merge pull request #1586 from bjwtaylor/ECDHE-PSK-integer-overflow 
Ecdhe psk integer overflow fix
 2026-06-16 11:49:54 +02:00
Ronald Cron
9b2a6cc914
Merge pull request #1663 from minosgalanakis/public-sync/development-14062026 
[Sync] Merge development into development-restricted
 2026-06-16 08:44:06 +02:00
Ronald Cron
8efcd8d700
Merge pull request #1603 from bjwtaylor/oob-key-exchange-restricted 
Add fix for OOB key exchange error
 2026-06-15 22:42:08 +02:00
Ben Taylor
a798b5804e Add CVE ID to ChangeLog 
Co-authored-by: Gilles Peskine <gilles.peskine@arm.com>
Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com>
 2026-06-15 13:27:02 +01:00
Ben Taylor
74555884cc Remove whitespace in ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-15 13:27:02 +01:00
Ben Taylor
351419f1ff Correct changelog style 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-15 13:27:02 +01:00
Ben Taylor
6443590448 Update ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-15 13:27:02 +01:00
Ben Taylor
4e797c14e0 Update ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-15 13:27:02 +01:00
Ben Taylor
e9ec4ce3ca Add ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-15 13:27:02 +01:00
Minos Galanakis
c508351e39 Merge remote-tracking branch 'public/development' into sync/development-14062026 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-14 19:32:58 +01:00
Ben Taylor
1aa1254546 Fix style issue 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-10 14:15:48 +01:00
Ronald Cron
1070ab8dd7
Merge pull request #1563 from minosgalanakis/security/mlfbyt4c_tls13_policy_bypass 
TLS1.3 client HRR policy bypass[ARM-MLFBYT4C]
 2026-06-10 13:04:24 +02:00
Ben Taylor
cecb4c2162 Correct ChangeLog style 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-10 08:21:05 +01:00
Ben Taylor
911b9b67db
Add CVE ID to ChangeLog 
Co-authored-by: Gilles Peskine <gilles.peskine@arm.com>
Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com>
 2026-06-08 15:48:14 +01:00
Ben Taylor
0c62b498bd Add ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-08 15:46:00 +01:00
Ben Taylor
5e04a32840
Add CVE to ChangeLog 
Co-authored-by: Ronald Cron <ronald.cron@arm.com>
Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com>
 2026-06-08 15:13:37 +01:00
Ben Taylor
4b32430d3c
Improve the wording of the ChangeLog 
Co-authored-by: Ronald Cron <ronald.cron@arm.com>
Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com>
 2026-06-08 15:13:02 +01:00
Gilles Peskine
e94a7a2d22 Add CVE-ID 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-06-05 11:35:46 +02:00
Gilles Peskine
ca89089968 Add attribution for the second bug 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-06-05 11:35:46 +02:00
Gilles Peskine
045cede1b8 basicConstraints with leading INTEGER field: document the behavior change 
Announce the security fix together with the overflow fix, since the two bugs
are pretty much indistinguishable from a black-box perspective, despite
being due to independent problems in the code.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-06-05 11:35:46 +02:00
Gilles Peskine
cc794d8501 Tighten CSR extensionRequest bounds 
Don't allow parts of a compound (SEQUENCE or SET) to go beyond the
containing compound.

The inline CSR regression test is derived from the existing "X509 CSR
ASN.1 (OK)" DER test vector. In the extensionRequest attribute, the original
well-formed fragment is:

    a029 3027 06092a864886f70d01090e 311a 3018 ...

where 31 1a is the SET containing the Extensions sequence and 30 18 is the
contained Extensions sequence. The malformed test changes only the SET
length byte, from 1a to 19:

    a029 3027 06092a864886f70d01090e 3119 3018 ...

The attribute SEQUENCE length and the inner Extensions sequence length are
left unchanged. This makes the SET one byte too short for its containing
attribute, so the parser must reject it with
MBEDTLS_ERR_ASN1_LENGTH_MISMATCH instead of parsing the trailing byte as
data outside the SET.

There is no known security impact, just some risk reduction.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-06-05 11:35:38 +02:00
Ben Taylor
a7c0d83354 Add improvements to ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-05 10:22:49 +01:00