yuzu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2025-01-23 20:31:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add ChangeLog entry

Browse source
This commit is contained in:
Hanno Becker 2017-06-09 11:30:33 +01:00
parent cc019084b8
commit 88647ace2b
1 changed files with 5 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
ChangeLog
View file

@ -3,6 +3,11 @@ mbed TLS ChangeLog (Sorted per branch, date)
= mbed TLS 2.1.x branch released xxxx-xx-xx = mbed TLS 2.1.x branch released xxxx-xx-xx
Security Security
* Fixed unlimited overread of heap-based buffer in mbedtls_ssl_read().
The issue could only happen client-side with renegotiation enabled.
Could result in DoS (application crash) or information leak
(if the application layer sent data read from mbedtls_ssl_read()
back to the server or to a third party). Can be triggered remotely.
* Add exponent blinding to RSA private operations as a countermeasure * Add exponent blinding to RSA private operations as a countermeasure
against side-channel attacks like the cache attack described in against side-channel attacks like the cache attack described in
https://arxiv.org/abs/1702.08719v2. https://arxiv.org/abs/1702.08719v2.