From 36d33f37b65f4843e089850a15038652ca694fa9 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Mon, 13 Dec 2021 12:43:11 +0100 Subject: [PATCH] Generalize MAC zeroization changelog entry Signed-off-by: Gilles Peskine --- ChangeLog.d/mac-zeroize.txt | 6 ++++++ ChangeLog.d/ssl-mac-zeroize.txt | 5 ----- 2 files changed, 6 insertions(+), 5 deletions(-) create mode 100644 ChangeLog.d/mac-zeroize.txt delete mode 100644 ChangeLog.d/ssl-mac-zeroize.txt diff --git a/ChangeLog.d/mac-zeroize.txt b/ChangeLog.d/mac-zeroize.txt new file mode 100644 index 0000000000..a43e34f845 --- /dev/null +++ b/ChangeLog.d/mac-zeroize.txt @@ -0,0 +1,6 @@ +Security + * Zeroize several intermediate variables used to calculate the expected + value when verifying a MAC or AEAD tag. This hardens the library in + case the value leaks through a memory disclosure vulnerability. For + example, a memory disclosure vulnerability could have allowed a + man-in-the-middle to inject fake ciphertext into a DTLS connection. diff --git a/ChangeLog.d/ssl-mac-zeroize.txt b/ChangeLog.d/ssl-mac-zeroize.txt deleted file mode 100644 index b49c7acd77..0000000000 --- a/ChangeLog.d/ssl-mac-zeroize.txt +++ /dev/null @@ -1,5 +0,0 @@ -Security - * Zeroize intermediate variables used to calculate the MAC in CBC cipher - suites. This hardens the library in case stack memory leaks through a - memory disclosure vulnerabilty, which could formerly have allowed a - man-in-the-middle to inject fake ciphertext into a DTLS connection.