coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-08-03 02:06:33 +08:00
Code Issues Packages Projects Releases Wiki Activity
34,600 Commits 183 Branches 286 Tags Multiple Licenses 216 MiB
Commit Graph

1809 Commits

Author SHA1 Message Date
Gilles Peskine
657760964e
Merge pull request #1660 from bjwtaylor/info-leak-in-ssl_write_new_session_ticket-4.1 
Info leak in ssl write new session ticket 4.1
 2026-06-24 09:42:16 +02:00
Gilles Peskine
7674b49934
Merge pull request #1656 from valeriosetti/issue1598-backport4.1 
[4.1] PKCS7 accepts weak hashes
 2026-06-23 16:40:44 +02:00
Ronald Cron
788a536868
Merge pull request #1673 from bjwtaylor/pkcs-free-stale-pointers-4.1 
Pkcs free stale pointers 4.1
 2026-06-22 17:54:49 +02:00
Valerio Setti
dfa6a1441e pkcs7: improve documentation and changelog for MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-22 11:46:29 +02:00
Valerio Setti
0b556f5a2d pkcs7: add MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES build symbol 
It allows weak hash algorithms to be used in PKCS7. It's only added in the
LTS branch for backward compatibility, but it's disabled by default because
that's the safest choice.

This commit also updates test data in order to test the new build symbol.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-22 11:46:29 +02:00
Valerio Setti
eb8c3f4b4d changelog: update documentation for PKCS7 changes 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-22 11:45:56 +02:00
Valerio Setti
2ae1ec8fdc changelog: add note for PKCS7 rejecting weak hash algorithms 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-22 11:45:56 +02:00
Gilles Peskine
2660eea3f0
Merge pull request #1629 from gilles-peskine-arm/basic-constaints-sequence-check-4.1 
Backport 4.1: Fix CA bit forgery through invalid basicConstraints
 2026-06-18 15:36:46 +02:00
Ben Taylor
5dabb64533 Add CVE ID to ChangeLog 
Co-authored-by: Gilles Peskine <gilles.peskine@arm.com>
Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com>
 2026-06-18 13:04:13 +01:00
Ben Taylor
a74bbc78e6 Remove whitespace in ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-18 13:04:13 +01:00
Ben Taylor
c4c4ef07c1 Correct changelog style 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-18 13:04:13 +01:00
Ben Taylor
15a6367373 Update ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-18 13:04:13 +01:00
Ben Taylor
54284cc451 Update ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-18 13:04:13 +01:00
Ben Taylor
434d7114a8 Add ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-18 13:04:13 +01:00
Gilles Peskine
49b13b34b3 Credit independent report 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-06-16 19:35:35 +02:00
Gilles Peskine
1f5b89077c
Merge pull request #1655 from bjwtaylor/ECDHE-PSK-integer-overflow-restricted-4.1 
Backport Ecdhe psk integer overflow restricted fix to  4.1
 2026-06-16 11:49:57 +02:00
Ronald Cron
5ea102945d
Merge pull request #1661 from minosgalanakis/public-sync/mbedtls-4.1-14062026 
[Sync] Merge mbedtls-4.1 into Merge mbedtls-4.1-restricted
 2026-06-16 09:02:13 +02:00
Ronald Cron
9d54126d0e
Merge pull request #1646 from bjwtaylor/oob-key-exchange-restricted-4.1 
Add fix for OOB key exchange error 4.1
 2026-06-15 22:42:15 +02:00
Ben Taylor
a98b95074a
Update ChangeLog to include CVE number 
Co-authored-by: Gilles Peskine <gilles.peskine@arm.com>
Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com>
 2026-06-15 09:20:59 +01:00
Minos Galanakis
e1896dbfd8 Merge remote-tracking branch 'public/mbedtls-4.1' into public-sync/mbedtls-4.1-14062026 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-14 19:36:52 +01:00
Ben Taylor
1a5e328377 Fix style issue 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-12 09:13:45 +01:00
Ben Taylor
f5cb455b5c Correct ChangeLog style 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-12 09:13:45 +01:00
Ben Taylor
ff8de9cec9 Add CVE to ChangeLog 
Co-authored-by: Ronald Cron <ronald.cron@arm.com>
Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com>
 2026-06-12 09:13:45 +01:00
Ben Taylor
4cb3470f91 Improve the wording of the ChangeLog 
Co-authored-by: Ronald Cron <ronald.cron@arm.com>
Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com>
 2026-06-12 09:13:45 +01:00
Ben Taylor
e9332e8ebe Add ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-11 16:24:04 +01:00
Ben Taylor
1e061ee95a Add reported by and CVE placeholder 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
(cherry picked from commit ab2a7d5a3472f39190344f754e6cee5039fcba50)
 2026-06-10 14:34:10 +01:00
Ben Taylor
afdbd67f21 Correct style of ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
(cherry picked from commit 0501e447cc19ed06b69daea5e17585e1294030cd)
 2026-06-10 14:34:10 +01:00
Ben Taylor
2705873c5a Improve ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
(cherry picked from commit c058818451833a748da112e3b8129fd299480ceb)
 2026-06-10 14:34:10 +01:00
Ben Taylor
93b10471aa Add ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
(cherry picked from commit e71e49e634ba49b2b630f268bc8f0dd392751ec3)
 2026-06-10 14:34:10 +01:00
Ronald Cron
b9af3cd809
Merge pull request #1608 from minosgalanakis/security/mlfbyt4c_tls13_policy_bypass_4.1 
Backport 4.1: TLS1.3 client HRR policy bypass[ARM-MLFBYT4C]
 2026-06-10 13:04:01 +02:00
Gilles Peskine
6181a54b57 Add CVE-ID 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-06-05 11:34:32 +02:00
Gilles Peskine
3345a59385 Add attribution for the second bug 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-06-05 11:34:32 +02:00
Gilles Peskine
0c8913d906 basicConstraints with leading INTEGER field: document the behavior change 
Announce the security fix together with the overflow fix, since the two bugs
are pretty much indistinguishable from a black-box perspective, despite
being due to independent problems in the code.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-06-05 11:34:32 +02:00
Gilles Peskine
44b833324b Tighten CSR extensionRequest bounds 
Don't allow parts of a compound (SEQUENCE or SET) to go beyond the
containing compound.

The inline CSR regression test is derived from the existing "X509 CSR
ASN.1 (OK)" DER test vector. In the extensionRequest attribute, the original
well-formed fragment is:

    a029 3027 06092a864886f70d01090e 311a 3018 ...

where 31 1a is the SET containing the Extensions sequence and 30 18 is the
contained Extensions sequence. The malformed test changes only the SET
length byte, from 1a to 19:

    a029 3027 06092a864886f70d01090e 3119 3018 ...

The attribute SEQUENCE length and the inner Extensions sequence length are
left unchanged. This makes the SET one byte too short for its containing
attribute, so the parser must reject it with
MBEDTLS_ERR_ASN1_LENGTH_MISMATCH instead of parsing the trailing byte as
data outside the SET.

There is no known security impact, just some risk reduction.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-06-05 11:34:13 +02:00
Ben Taylor
0cc307762a Add ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-05 10:21:36 +01:00
Ronald Cron
a73dce874b
Merge pull request #1588 from gilles-peskine-arm/ssl_tls13_prepare_new_session_ticket-psa_get_random-4.1 
Backport 4.1: Fix ssl_tls13_prepare_new_session_ticket returning 1 on an RNG failure
 2026-05-29 16:20:07 +02:00
Gilles Peskine
b05434c1b1 Improve changelog wording 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-05-28 16:32:35 +02:00
Valerio Setti
bd57fb5e8a changelog: fix typos 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-05-28 13:07:51 +02:00
Valerio Setti
f0ed933ca8 changelog: add note about issue 1569 resolution 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-05-28 13:07:51 +02:00
Gilles Peskine
9007fc4b9b Fix lax basicConstraints parsing 
When parsing the basicConstraints extension, reject junk after the SEQUENCE
inside the extension (which is probably benign), and reject a SEQUENCE that
extends beyond the extension (could be very dangerous).

Add a non-regression test where a certificate that is technically malformed,
but accepted as a leaf certificate by OpenSSL and other X.509
implementations, to be accepted as a CA certificate by Mbed TLS.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-05-26 20:51:52 +02:00
Janos Follath
a4f79350ac
Merge pull request #10742 from valeriosetti/backport-pr10741 
[backport 4.1] mbedtls_config.c missing mbedtls_platform_requirements.h
 2026-05-26 09:24:50 +00:00
Minos Galanakis
45ca9e1e06 Added ChangeLog 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-05-12 15:02:05 +01:00
Gilles Peskine
465d6e9669 Fix ssl_tls13_prepare_new_session_ticket returning 1 on an RNG failure 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-05-04 18:44:05 +02:00
Valerio Setti
cfb07a923d changelog: add note about fix of issue 10740 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2026-04-29 17:10:04 +02:00
minosgalanakis
8f8b35b41c
Merge pull request #10711 from valord577/patch-1-backport-v4 
[backport 4.1 #10695] Fix build warning/error using llvm-mingw
 2026-04-29 14:52:04 +00:00
Gilles Peskine
ded271a8c4
Merge pull request #10696 from yiwu0b11/destdir_install_env_support-4.1 
Backport 4.1: Support DESTDIR for install and add build-system test
 2026-04-29 14:37:40 +00:00
valord577
fce010911c update ChangeLog 
Signed-off-by: valord577 <valord577@gmail.com>
 2026-04-22 11:09:29 +08:00
valord577
3bf4af0838 add ChangeLog 
Signed-off-by: valord577 <valord577@gmail.com>
 2026-04-22 11:09:21 +08:00
Yi Wu
0dc58e196d ChangeLog fix 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-04-20 10:48:29 +01:00
Yi Wu
f645b06c38 ChangeLog fixes 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-04-20 10:48:29 +01:00