Update ChangeLog with language and technical corrections
To clarify and correct the ChangeLog.
This commit is contained in:
parent
98b9373849
commit
55fc4e0c5a
77
ChangeLog
77
ChangeLog
@ -1,44 +1,46 @@
|
||||
mbed TLS ChangeLog (Sorted per branch, date)
|
||||
|
||||
= mbed TLS x.x.x branch released xxxx-xx-xx
|
||||
= mbed TLS 2.7.0 branch released 2018-02-03
|
||||
|
||||
Security
|
||||
* Fix buffer overflow in RSA-PSS verification when the hash is too
|
||||
large for the key size. Found by Seth Terashima, Qualcomm Product
|
||||
Security Initiative, Qualcomm Technologies Inc.
|
||||
* Fix buffer overflow in RSA-PSS verification when the unmasked
|
||||
data is all zeros.
|
||||
* Fix unsafe bounds check in ssl_parse_client_psk_identity() when adding
|
||||
64kB to the address of the SSL buffer wraps around.
|
||||
* Fix a potential heap buffer overflow in mbedtls_ssl_write. When the (by
|
||||
* Fix a heap corruption issue in the implementation of the truncated HMAC
|
||||
extension. When the truncated HMAC extension is enabled and CBC is used,
|
||||
sending a malicious application packet could be used to selectively corrupt
|
||||
6 bytes on the peer's heap, which could potentially lead to crash or remote
|
||||
code execution. The issue could be triggered remotely from either side in
|
||||
both TLS and DTLS. CVE-2018-0488
|
||||
* Fix a buffer overflow in RSA-PSS verification when the hash was too large
|
||||
for the key size, which could potentially lead to crash or remote code
|
||||
execution. Found by Seth Terashima, Qualcomm Product Security Initiative,
|
||||
Qualcomm Technologies Inc. CVE-2018-0487
|
||||
* Fix buffer overflow in RSA-PSS verification when the unmasked data is all
|
||||
zeros.
|
||||
* Fix an unsafe bounds check in ssl_parse_client_psk_identity() when adding
|
||||
64 KiB to the address of the SSL buffer and causing a wrap around.
|
||||
* Fix a potential heap buffer overflow in mbedtls_ssl_write(). When the (by
|
||||
default enabled) maximum fragment length extension is disabled in the
|
||||
config and the application data buffer passed to mbedtls_ssl_write
|
||||
is larger than the internal message buffer (16384 bytes by default), the
|
||||
latter overflows. The exploitability of this issue depends on whether the
|
||||
application layer can be forced into sending such large packets. The issue
|
||||
was independently reported by Tim Nordell via e-mail and by Florin Petriuc
|
||||
and sjorsdewit on GitHub. Fix proposed by Florin Petriuc in #1022. Fixes #707.
|
||||
* Tighten should-be-constant-time memcmp against compiler optimizations.
|
||||
and sjorsdewit on GitHub. Fix proposed by Florin Petriuc in #1022.
|
||||
Fixes #707.
|
||||
* Add a provision to prevent compiler optimizations breaking the time
|
||||
constancy of mbedtls_ssl_safer_memcmp().
|
||||
* Ensure that buffers are cleared after use if they contain sensitive data.
|
||||
Changes were introduced in multiple places in the library.
|
||||
* Set PEM buffer to zero before freeing it, to avoid decoded private keys
|
||||
being leaked to memory after release.
|
||||
* Fix dhm_check_range() failing to detect trivial subgroups and potentially
|
||||
leaking 1 bit of the private key. Reported by prashantkspatil.
|
||||
* Make mbedtls_mpi_read_binary constant-time with respect to
|
||||
the input data. Previously, trailing zero bytes were detected
|
||||
and omitted for the sake of saving memory, but potentially
|
||||
leading to slight timing differences.
|
||||
Reported by Marco Macchetti, Kudelski Group.
|
||||
* Make mbedtls_mpi_read_binary() constant-time with respect to the input
|
||||
data. Previously, trailing zero bytes were detected and omitted for the
|
||||
sake of saving memory, but potentially leading to slight timing
|
||||
differences. Reported by Marco Macchetti, Kudelski Group.
|
||||
* Wipe stack buffer temporarily holding EC private exponent
|
||||
after keypair generation.
|
||||
* Fix heap corruption in implementation of truncated HMAC extension.
|
||||
When the truncated HMAC extension is enabled and CBC is used,
|
||||
sending a malicious application packet can be used to selectively
|
||||
corrupt 6 bytes on the peer's heap, potentially leading to crash or
|
||||
remote code execution. This can be triggered remotely from either
|
||||
side in both TLS and DTLS.
|
||||
* Fix a potential heap buffer overread in ALPN extension parsing
|
||||
* Fix a potential heap buffer over-read in ALPN extension parsing
|
||||
(server-side). Could result in application crash, but only if an ALPN
|
||||
name larger than 16 bytes had been configured on the server.
|
||||
* Change default choice of DHE parameters from untrustworthy RFC 5114
|
||||
@ -69,11 +71,12 @@ Features
|
||||
mbedtls_ecdh_gen_public() and mbedtls_ecdh_compute_shared().
|
||||
* Add support for alternative implementation of ECJPAKE, controlled by
|
||||
the new configuration flag MBEDTLS_ECJPAKE_ALT.
|
||||
* Add mechanism to provide alternative implementation of the DHM module.
|
||||
|
||||
API Changes
|
||||
* Extend RSA interface by multiple functions allowing structure-
|
||||
independent setup and export of RSA contexts. Most notably,
|
||||
mbedtls_rsa_import and mbedtls_rsa_complete are introduced for setting
|
||||
mbedtls_rsa_import() and mbedtls_rsa_complete() are introduced for setting
|
||||
up RSA contexts from partial key material and having them completed to the
|
||||
needs of the implementation automatically. This allows to setup private RSA
|
||||
contexts from keys consisting of N,D,E only, even if P,Q are needed for the
|
||||
@ -91,7 +94,7 @@ API Changes
|
||||
|
||||
New deprecations
|
||||
* Deprecate usage of RSA primitives with non-matching key-type
|
||||
(e.g., signing with a public key).
|
||||
(e.g. signing with a public key).
|
||||
* Direct manipulation of structure fields of RSA contexts is deprecated.
|
||||
Users are advised to use the extended RSA API instead.
|
||||
* Deprecate usage of message digest functions that return void
|
||||
@ -104,8 +107,8 @@ New deprecations
|
||||
* Deprecate hex string DHE constants MBEDTLS_DHM_RFC3526_MODP_2048_P etc.
|
||||
Supserseded by binary encoded constants MBEDTLS_DHM_RFC3526_MODP_2048_P_BIN
|
||||
etc.
|
||||
* Deprecate mbedtls_ssl_conf_dh_param for setting default DHE parameters
|
||||
from hex strings. Superseded by mbedtls_ssl_conf_dh_param_bin
|
||||
* Deprecate mbedtls_ssl_conf_dh_param() for setting default DHE parameters
|
||||
from hex strings. Superseded by mbedtls_ssl_conf_dh_param_bin()
|
||||
accepting DHM parameters in binary form, matching the new constants.
|
||||
|
||||
Bugfix
|
||||
@ -141,11 +144,11 @@ Bugfix
|
||||
* Don't print X.509 version tag for v1 CRT's, and omit extensions for
|
||||
non-v3 CRT's.
|
||||
* Fix bugs in RSA test suite under MBEDTLS_NO_PLATFORM_ENTROPY. #1023 #1024
|
||||
* Fix net_would_block to avoid modification by errno through fcntl call.
|
||||
* Fix net_would_block() to avoid modification by errno through fcntl() call.
|
||||
Found by nkolban. Fixes #845.
|
||||
* Fix handling of handshake messages in mbedtls_ssl_read in case
|
||||
* Fix handling of handshake messages in mbedtls_ssl_read() in case
|
||||
MBEDTLS_SSL_RENEGOTIATION is disabled. Found by erja-gp.
|
||||
* Add a check for invalid private parameters in mbedtls_ecdsa_sign.
|
||||
* Add a check for invalid private parameters in mbedtls_ecdsa_sign().
|
||||
Reported by Yolan Romailler.
|
||||
* Fix word size check in in pk.c to not depend on MBEDTLS_HAVE_INT64.
|
||||
* Fix incorrect unit in benchmark output. #850
|
||||
@ -154,7 +157,7 @@ Bugfix
|
||||
* Fix crash when calling mbedtls_ssl_cache_free() twice. Found by
|
||||
MilenkoMitrovic, #1104
|
||||
* Fix mbedtls_timing_alarm(0) on Unix and MinGW.
|
||||
* Fix use of uninitialized memory in mbedtls_timing_get_timer when reset=1.
|
||||
* Fix use of uninitialized memory in mbedtls_timing_get_timer() when reset=1.
|
||||
* Fix possible memory leaks in mbedtls_gcm_self_test().
|
||||
* Added missing return code checks in mbedtls_aes_self_test().
|
||||
* Fix issues in RSA key generation program programs/x509/rsa_genkey and the
|
||||
@ -164,9 +167,10 @@ Bugfix
|
||||
* Fix error message in programs/pkey/gen_key.c. Found and fixed by Chris Xue.
|
||||
* Fix programs/pkey/dh_server.c so that it actually works with dh_client.c.
|
||||
Found and fixed by Martijn de Milliano.
|
||||
* Fix bug in cipher decryption with MBEDTLS_PADDING_ONE_AND_ZEROS that
|
||||
sometimes accepted invalid padding. (Not used in TLS.) Found and fixed
|
||||
by Micha Kraus.
|
||||
* Fix an issue in the cipher decryption with the mode
|
||||
MBEDTLS_PADDING_ONE_AND_ZEROS that sometimes accepted invalid padding.
|
||||
Note, this padding mode is not used by the TLS protocol. Found and fixed by
|
||||
Micha Kraus.
|
||||
* Fix the entropy.c module to not call mbedtls_sha256_starts() or
|
||||
mbedtls_sha512_starts() in the mbedtls_entropy_init() function.
|
||||
* Fix the entropy.c module to ensure that mbedtls_sha256_init() or
|
||||
@ -174,9 +178,11 @@ Bugfix
|
||||
structure. Do not assume that zeroizing a context is a correct way to
|
||||
reset it. Found independently by ccli8 on Github.
|
||||
* In mbedtls_entropy_free(), properly free the message digest context.
|
||||
* Fix status handshake status message in programs/ssl/dtls_client.c. Found
|
||||
and fixed by muddog.
|
||||
|
||||
Changes
|
||||
* Extend cert_write example program by options to set the CRT version
|
||||
* Extend cert_write example program by options to set the certificate version
|
||||
and the message digest. Further, allow enabling/disabling of authority
|
||||
identifier, subject identifier and basic constraints extensions.
|
||||
* Only check for necessary RSA structure fields in `mbedtls_rsa_private`. In
|
||||
@ -186,7 +192,6 @@ Changes
|
||||
* Only run AES-192 self-test if AES-192 is available. Fixes #963.
|
||||
* Tighten the RSA PKCS#1 v1.5 signature verification code and remove the
|
||||
undeclared dependency of the RSA module on the ASN.1 module.
|
||||
* Add mechanism to provide alternative implementation of the DHM module.
|
||||
* Update all internal usage of deprecated message digest functions to the
|
||||
new ones with return codes. In particular, this modifies the
|
||||
mbedtls_md_info_t structure. Propagate errors from these functions
|
||||
|
Loading…
Reference in New Issue
Block a user