From 32a38dfec586f5b721592b46d4f4a21da99c082e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Wed, 15 Jun 2022 10:50:18 +0200 Subject: [PATCH] Add ChangeLog for potential overread with USE_PSA MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The issue was fixed while adding support for static ECDH with Opaque keys: https://github.com/Mbed-TLS/mbedtls/pull/5624 This is just adding the ChangeLog entry for that fix. Signed-off-by: Manuel Pégourié-Gonnard --- ChangeLog.d/buf-overread-use-psa-static-ecdh.txt | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 ChangeLog.d/buf-overread-use-psa-static-ecdh.txt diff --git a/ChangeLog.d/buf-overread-use-psa-static-ecdh.txt b/ChangeLog.d/buf-overread-use-psa-static-ecdh.txt new file mode 100644 index 0000000000..7eff12a307 --- /dev/null +++ b/ChangeLog.d/buf-overread-use-psa-static-ecdh.txt @@ -0,0 +1,7 @@ +Security + * Fix a potential heap buffer overread in TLS 1.2 server-side when + MBEDTLS_USE_PSA_CRYPTO is enabled, an opaque key (created with + mbedtls_pk_setup_opaque()) is provisioned, and a static ECDH ciphersuite + is selected. This may result in an application crash. No path to + information leak has been identified. +