coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-10-30 19:07:48 +08:00
Code Issues Packages Projects Releases Wiki Activity
34,795 Commits 183 Branches 286 Tags 207 MiB
Commit Graph

1850 Commits

Author SHA1 Message Date
Gilles Peskine
d8d5ea7cbc
Merge pull request #10965 from bjwtaylor/tl13-transform-resource-leak-4.1 
Backport 4.1: Fix resource leak in populate transform
 2026-10-27 12:34:51 +00:00
Valerio Setti
0d13af54a8
Merge pull request #10799 from bjwtaylor/no-program-failure-4.1 
Backport 4.1: Add fix for -DENABLE_PROGRAMS=OFF build error
 2026-10-21 15:41:24 +00:00
Gilles Peskine
5e889b385f
Merge pull request #10985 from MechatronikMonkey/fix-empty-authority-key-id-4.1 
Backport 4.1: x509_crt: accept empty AuthorityKeyIdentifier sequence
 2026-10-21 15:12:21 +00:00
Gilles Peskine
9ce9b40d84
Merge pull request #10929 from nvxbug/tls12-handshake-len-bounds-4.1 
Backport 4.1: Fix off-by-one over-read in TLS 1.2 ClientHello and CertificateRequest
 2026-10-21 15:08:41 +00:00
v1rtu3x
f429097cdd x509: Accept basicConstraints with omitted cA 
RFC 5280 defines cA as BOOLEAN DEFAULT FALSE, so a basicConstraints
extension containing only pathLenConstraint (SEQUENCE { INTEGER n })
is syntactically valid and must be interpreted as cA=FALSE. The fix
for CVE-2026-49300 rejected this encoding outright, breaking
compatibility with certificates emitted by devices such as
Eaton/CODESYS PLCs.

Tolerate MBEDTLS_ERR_ASN1_UNEXPECTED_TAG from the cA BOOLEAN parse,
keeping cA FALSE and letting the existing INTEGER parser validate
pathLenConstraint. The INTEGER value is never used to determine cA,
so the CVE fix is preserved.

Fixes #11006

Signed-off-by: v1rtu3x <149050962+v1rtu3x@users.noreply.github.com>
(cherry picked from commit 62dd8a556c01cc289d4fb3f19352a78ede90dac2)
 2026-10-21 12:55:10 +03:00
Ben Taylor
7de85af87f Add ChangeLog for transform resource leak 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
(cherry picked from commit 5b4be7edaffe86553b4875f80c78c3befe4ae618)
 2026-10-21 08:27:44 +01:00
subotac
7b0eb04af9 Reject overflowing numeric OID components 
Backport of f79eac885dec294d6e441bada15be1605dcb75b0.

Refs Mbed-TLS/mbedtls#10911.

Signed-off-by: subotac <73706465+subotac@users.noreply.github.com>
 2026-10-06 23:18:15 +03:00
Manuel Pégourié-Gonnard
14501f4503
Merge pull request #10993 from saadgodikat/backport-10973-4.1 
[4.1] Fix DER certificate output on Windows
 2026-10-06 10:13:44 +00:00
saadgodikat
b6d441ed52 Add changelog for DER certificate output fix 
Signed-off-by: saadgodikat <saadgodikat601@gmail.com>
 2026-10-05 16:15:16 +05:30
Naveed
5ece3de4d2 Reject out-of-bounds ALPN length in ssl_context_load 
The serialized ALPN length was passed to memcmp() against each configured protocol without checking it against the remaining serialized data, so a malformed context could read past the end of the buffer. Bound it before the comparison, like the adjacent CID fields.

Signed-off-by: Naveed <naveed@bugqore.com>
 2026-10-04 22:44:49 +05:30
Christopher Müller
04e572bcda Add ChangeLog entry for empty AuthorityKeyIdentifier 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Christopher Müller <chris@mechatronikmonkey.de>
 2026-10-03 14:28:34 +02:00
Yi Wu
231807ff87 CMake: separate base config 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-08-27 12:34:42 +02:00
Yi Wu
c744bdc7fe CMake: support custom base configurations 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-08-27 12:34:42 +02:00
Yi Wu
3008501bf1 Cmake: add support for config options 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-08-27 12:34:42 +02:00
Naveed
8a69d73b79 rework handshake length checks per review 
ClientHello: narrow the session-id check to the session id itself, check
the cookie length byte before reading it, and let the ciphersuite-list
length check cover both transports.

CertificateRequest: make the signature-algorithms check also reserve the
two certificate-authorities length bytes instead of adding a separate
check, use the available < needed pattern throughout, and reject an
odd-length signature-algorithms list.

Add injected truncated-ClientHello test cases (TLS 1.2-only builds).

Signed-off-by: Naveed <naveed@bugqore.com>
 2026-08-24 21:52:19 +05:30
Naveed
46771343fc bound two-byte length reads in tls 1.2 handshake parsing 
Signed-off-by: Naveed <naveed@bugqore.com>
 2026-08-24 21:52:19 +05:30
Naveed
1933e828d0 Reject out-of-bounds session ID length in ssl_tls12_session_load 
Signed-off-by: Naveed <naveed@bugqore.com>
 2026-08-03 13:44:23 +05:30
Ben Taylor
4204532c9e Update Changelog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-07-02 13:33:22 +01:00
Ben Taylor
617f4d373d Add changelog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-07-02 13:33:22 +01:00
Minos Galanakis
5089e9f623 Assemble Changelog 
./framework/scripts/assemble_changelog.py

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-29 18:28:30 +01:00
Minos Galanakis
b05e6e0e0a Merge remote-tracking branch 'mbedtls-4.1-restricted' into mbedtls-4.1.1.rc 2026-06-26 22:05:03 +01:00
Ronald Cron
c0dbff0cf8
Merge pull request #1683 from valeriosetti/issue1585-backport4.1 
[4.1] Stale DTLS- SRTP negotiation state after session_reset() (ARM-RZ7EMQAA)
 2026-06-26 12:17:19 +02:00
Ronald Cron
316296466b
Merge pull request #1686 from minosgalanakis/security/mlfbyt4c_tls13_policy_bypass_changelog_4.1 
Add Attribution CVE mbedtls:mbedtls4.1-restricted
 2026-06-25 15:57:24 +02:00
Ronald Cron
c4db00209a Add change log 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:00:25 +02:00
Minos Galanakis
1d3ac2843c Changelog. Added attribution/CVE for 1569 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-24 14:40:53 +01:00
Valerio Setti
f4dcb5c692 changelog: add note for documentation fix for mbedtls_ssl_set_cid 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-24 14:42:10 +02:00
Valerio Setti
f8a7d87fe1 changelog: add reset for some fields of the SSL context structure 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-24 14:42:10 +02:00
Ben Taylor
52a1b95067 Update ChangeLog with CVE number 
Co-authored-by: Ronald Cron <ronald.cron@arm.com>
Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com>
 2026-06-24 11:05:44 +01:00
Ben Taylor
3e6608a5b6 Update ChangeLog to add CVE 
Co-authored-by: Gilles Peskine <gilles.peskine@arm.com>
Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com>
 2026-06-24 11:05:44 +01:00
Ben Taylor
470aeeed9d Improve ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 11:05:44 +01:00
Ben Taylor
6ed6d0e491 Update ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 11:05:44 +01:00
Ben Taylor
b0f812d68d Fix reporters in ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 11:05:44 +01:00
Ben Taylor
f9a3d649ff Tidy up ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 11:05:44 +01:00
Ben Taylor
8c27b60597 Add Reported by to ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 11:05:44 +01:00
Ben Taylor
d6019b932d Add security impact 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 11:05:43 +01:00
Ben Taylor
29bdcc319a Update ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 11:05:43 +01:00
Ben Taylor
d066076211 Add ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 11:05:43 +01:00
Gilles Peskine
657760964e
Merge pull request #1660 from bjwtaylor/info-leak-in-ssl_write_new_session_ticket-4.1 
Info leak in ssl write new session ticket 4.1
 2026-06-24 09:42:16 +02:00
Gilles Peskine
7674b49934
Merge pull request #1656 from valeriosetti/issue1598-backport4.1 
[4.1] PKCS7 accepts weak hashes
 2026-06-23 16:40:44 +02:00
Minos Galanakis
a6d2af8cdb Added attribution 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-23 10:52:01 +01:00
Minos Galanakis
5998104fd6 Added CVE 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-22 22:35:54 +01:00
Ronald Cron
788a536868
Merge pull request #1673 from bjwtaylor/pkcs-free-stale-pointers-4.1 
Pkcs free stale pointers 4.1
 2026-06-22 17:54:49 +02:00
Valerio Setti
dfa6a1441e pkcs7: improve documentation and changelog for MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-22 11:46:29 +02:00
Valerio Setti
0b556f5a2d pkcs7: add MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES build symbol 
It allows weak hash algorithms to be used in PKCS7. It's only added in the
LTS branch for backward compatibility, but it's disabled by default because
that's the safest choice.

This commit also updates test data in order to test the new build symbol.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-22 11:46:29 +02:00
Valerio Setti
eb8c3f4b4d changelog: update documentation for PKCS7 changes 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-22 11:45:56 +02:00
Valerio Setti
2ae1ec8fdc changelog: add note for PKCS7 rejecting weak hash algorithms 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-22 11:45:56 +02:00
Gilles Peskine
e106d8ad1c
Merge pull request #10761 from Nadav0077/harden-serialized-load-4.1 
Backport to 4.1: harden serialized data deserialization
 2026-06-19 20:18:03 +00:00
Gilles Peskine
2660eea3f0
Merge pull request #1629 from gilles-peskine-arm/basic-constaints-sequence-check-4.1 
Backport 4.1: Fix CA bit forgery through invalid basicConstraints
 2026-06-18 15:36:46 +02:00
Ben Taylor
5dabb64533 Add CVE ID to ChangeLog 
Co-authored-by: Gilles Peskine <gilles.peskine@arm.com>
Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com>
 2026-06-18 13:04:13 +01:00
Ben Taylor
a74bbc78e6 Remove whitespace in ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-18 13:04:13 +01:00