From c12113a61aab40aba365f5d6abbf971ba52dc6b8 Mon Sep 17 00:00:00 2001
From: Gilles Peskine <Gilles.Peskine@arm.com>
Date: Thu, 29 Nov 2018 12:46:05 +0100
Subject: [PATCH] Add changelog entry for mbedtls_mpi_write_binary fix

---
 ChangeLog | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index a60799d81..d33680843 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -9,6 +9,13 @@ Security
      RSA decryption (i.e. ciphersuites whose name contains RSA but not
      (EC)DH(E)). Reported by Eyal Ronen, Robert Gillham, Daniel Genkin, Adi
      Shamir, David Wong and Yuval Yarom. CVE-2018-19608
+   * In mbedtls_mpi_write_binary(), don't leak the exact size of the number
+     via branching and memory access patterns. An attacker who could submit
+     a plaintext for RSA PKCS#1 v1.5 decryption but only observe the timing
+     of the decryption and not its result could nonetheless decrypt RSA
+     plaintexts and forge RSA signatures. Other asymmetric algorithms may
+     have been similarly vulnerable. Reported by Eyal Ronen, Robert Gillham,
+     Daniel Genkin, Adi Shamir, David Wong and Yuval Yarom.
 
 Bugfix
     * Fix failure in hmac_drbg in the benchmark sample application, when