TeamHepta/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-04-14 08:02:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

Adapt ChangeLog

Browse Source
This commit is contained in:
Hanno Becker
2017-11-20 10:43:35 +00:00
parent ce516ff449
commit b09c5721f5
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
ChangeLog
View File

@@ -3,6 +3,14 @@ mbed TLS ChangeLog (Sorted per branch, date)
= mbed TLS 2.1.10 branch released 2017-xx-xx
Security
* Fix heap corruption in implementation of truncated HMAC extension.
When the truncated HMAC extension is enabled and CBC is used,
sending a malicious application packet can be used to selectively
corrupt 6 bytes on the peer's heap, potentially leading to crash or
remote code execution. This can be triggered remotely from either
side in both TLS and DTLS.
Bugfix
* Fix ssl_parse_record_header() to silently discard invalid DTLS records
as recommended in RFC 6347 Section 4.1.2.7.