From c3ab4053ad265ce2f17d053b8a49612157ed8e68 Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Wed, 9 Dec 2020 00:34:41 +0000 Subject: [PATCH] Assemble ChangeLog Executed scripts/assemble_changelog.py. Signed-off-by: Janos Follath --- ChangeLog | 46 +++++++++++++++++++ .../adjusting sliding_window_size_PR3592.txt | 3 -- ChangeLog.d/aes-zeroize-pointer.txt | 5 -- ChangeLog.d/bugfix-2927.txt | 3 -- ChangeLog.d/bugfix_3782.txt | 2 - ChangeLog.d/ecb_iv_fix.txt | 3 -- ChangeLog.d/ecp-bignum-error-checks.txt | 5 -- ChangeLog.d/fix-rsa-blinding.txt | 6 --- ...it_size_of_diffie_hellman_calculations.txt | 4 -- ...x509-add-tag-check-to-algorithm-params.txt | 11 ----- ...ons_of_sensitive_data_in_PKCS5_and_SHA.txt | 6 --- 11 files changed, 46 insertions(+), 48 deletions(-) delete mode 100644 ChangeLog.d/adjusting sliding_window_size_PR3592.txt delete mode 100644 ChangeLog.d/aes-zeroize-pointer.txt delete mode 100644 ChangeLog.d/bugfix-2927.txt delete mode 100644 ChangeLog.d/bugfix_3782.txt delete mode 100644 ChangeLog.d/ecb_iv_fix.txt delete mode 100644 ChangeLog.d/ecp-bignum-error-checks.txt delete mode 100644 ChangeLog.d/fix-rsa-blinding.txt delete mode 100644 ChangeLog.d/limit_size_of_diffie_hellman_calculations.txt delete mode 100644 ChangeLog.d/x509-add-tag-check-to-algorithm-params.txt delete mode 100644 ChangeLog.d/zeroizations_of_sensitive_data_in_PKCS5_and_SHA.txt diff --git a/ChangeLog b/ChangeLog index 384df3c44..d6ea57e98 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,51 @@ mbed TLS ChangeLog (Sorted per branch, date) += mbed TLS x.x.x branch released xxxx-xx-xx + +Security + * Limit the size of calculations performed by mbedtls_mpi_exp_mod to + MBEDTLS_MPI_MAX_SIZE to prevent a potential denial of service when + generating Diffie-Hellman key pairs. Credit to OSS-Fuzz. + * Fix a compliance issue whereby we were not checking the tag on the + algorithm parameters (only the size) when comparing the signature in the + description part of the cert to the real signature. This meant that a + NULL algorithm parameters entry would look identical to an array of REAL + (size zero) to the library and thus the certificate would be considered + valid. However, if the parameters do not match in *any* way then the + certificate should be considered invalid, and indeed OpenSSL marks these + certs as invalid when mbedtls did not. + Many thanks to guidovranken who found this issue via differential fuzzing + and reported it in #3629. + * Zeroising of local buffers and variables which are used for calculations + in mbedtls_pkcs5_pbkdf2_hmac(), mbedtls_internal_sha*_process(), + mbedtls_internal_md*_process() and mbedtls_internal_ripemd160_process() + functions to erase sensitive data from memory. Reported by + Johan Malmgren and Johan Uppman Bruce from Sectra. + +Bugfix + * Fix rsa_prepare_blinding() to retry when the blinding value is not + invertible (mod N), instead of returning MBEDTLS_ERR_RSA_RNG_FAILED. This + addresses a regression but is rare in practice (approx. 1 in 2/sqrt(N)). + Found by Synopsys Coverity, fix contributed by Peter Kolbus (Garmin). + Fixes #3647. + * Correct the default IV size for mbedtls_cipher_info_t structures using + MBEDTLS_MODE_ECB to 0, since ECB mode ciphers don't use IVs. + * Fix build failures on GCC 11. Fixes #3782. + * Fix a memory leak in mbedtls_mpi_sub_abs() when the result was negative + (an error condition) and the second operand was aliased to the result. + * Fix a case in elliptic curve arithmetic where an out-of-memory condition + could go undetected, resulting in an incorrect result. + * In CTR_DRBG and HMAC_DRBG, don't reset the reseed interval in seed(). + Fixes #2927. + +Changes + * Reduce stack usage significantly during sliding window exponentiation. + Reported in #3591 and fix contributed in #3592 by Daniel Otte. + * Remove the zeroization of a pointer variable in AES rounds. It was valid + but spurious and misleading since it looked like a mistaken attempt to + zeroize the pointed-to buffer. Reported by Antonio de la Piedra, CEA + Leti, France. + = mbed TLS 2.7.17 branch released 2020-09-01 Features diff --git a/ChangeLog.d/adjusting sliding_window_size_PR3592.txt b/ChangeLog.d/adjusting sliding_window_size_PR3592.txt deleted file mode 100644 index 608956541..000000000 --- a/ChangeLog.d/adjusting sliding_window_size_PR3592.txt +++ /dev/null @@ -1,3 +0,0 @@ -Changes - * Reduce stack usage significantly during sliding window exponentiation. - Reported in #3591 and fix contributed in #3592 by Daniel Otte. diff --git a/ChangeLog.d/aes-zeroize-pointer.txt b/ChangeLog.d/aes-zeroize-pointer.txt deleted file mode 100644 index ccc6dc159..000000000 --- a/ChangeLog.d/aes-zeroize-pointer.txt +++ /dev/null @@ -1,5 +0,0 @@ -Changes - * Remove the zeroization of a pointer variable in AES rounds. It was valid - but spurious and misleading since it looked like a mistaken attempt to - zeroize the pointed-to buffer. Reported by Antonio de la Piedra, CEA - Leti, France. diff --git a/ChangeLog.d/bugfix-2927.txt b/ChangeLog.d/bugfix-2927.txt deleted file mode 100644 index 2213c6ee4..000000000 --- a/ChangeLog.d/bugfix-2927.txt +++ /dev/null @@ -1,3 +0,0 @@ -Bugfix - * In CTR_DRBG and HMAC_DRBG, don't reset the reseed interval in seed(). - Fixes #2927. diff --git a/ChangeLog.d/bugfix_3782.txt b/ChangeLog.d/bugfix_3782.txt deleted file mode 100644 index a92dffa28..000000000 --- a/ChangeLog.d/bugfix_3782.txt +++ /dev/null @@ -1,2 +0,0 @@ -Bugfix - * Fix build failures on GCC 11. Fixes #3782. diff --git a/ChangeLog.d/ecb_iv_fix.txt b/ChangeLog.d/ecb_iv_fix.txt deleted file mode 100644 index ae2ae2543..000000000 --- a/ChangeLog.d/ecb_iv_fix.txt +++ /dev/null @@ -1,3 +0,0 @@ -Bugfix - * Correct the default IV size for mbedtls_cipher_info_t structures using - MBEDTLS_MODE_ECB to 0, since ECB mode ciphers don't use IVs. diff --git a/ChangeLog.d/ecp-bignum-error-checks.txt b/ChangeLog.d/ecp-bignum-error-checks.txt deleted file mode 100644 index 8cad08e97..000000000 --- a/ChangeLog.d/ecp-bignum-error-checks.txt +++ /dev/null @@ -1,5 +0,0 @@ -Bugfix - * Fix a memory leak in mbedtls_mpi_sub_abs() when the result was negative - (an error condition) and the second operand was aliased to the result. - * Fix a case in elliptic curve arithmetic where an out-of-memory condition - could go undetected, resulting in an incorrect result. diff --git a/ChangeLog.d/fix-rsa-blinding.txt b/ChangeLog.d/fix-rsa-blinding.txt deleted file mode 100644 index a13572c9a..000000000 --- a/ChangeLog.d/fix-rsa-blinding.txt +++ /dev/null @@ -1,6 +0,0 @@ -Bugfix - * Fix rsa_prepare_blinding() to retry when the blinding value is not - invertible (mod N), instead of returning MBEDTLS_ERR_RSA_RNG_FAILED. This - addresses a regression but is rare in practice (approx. 1 in 2/sqrt(N)). - Found by Synopsys Coverity, fix contributed by Peter Kolbus (Garmin). - Fixes #3647. diff --git a/ChangeLog.d/limit_size_of_diffie_hellman_calculations.txt b/ChangeLog.d/limit_size_of_diffie_hellman_calculations.txt deleted file mode 100644 index 2ba98d541..000000000 --- a/ChangeLog.d/limit_size_of_diffie_hellman_calculations.txt +++ /dev/null @@ -1,4 +0,0 @@ -Security - * Limit the size of calculations performed by mbedtls_mpi_exp_mod to - MBEDTLS_MPI_MAX_SIZE to prevent a potential denial of service when - generating Diffie-Hellman key pairs. Credit to OSS-Fuzz. diff --git a/ChangeLog.d/x509-add-tag-check-to-algorithm-params.txt b/ChangeLog.d/x509-add-tag-check-to-algorithm-params.txt deleted file mode 100644 index f2c72b0ec..000000000 --- a/ChangeLog.d/x509-add-tag-check-to-algorithm-params.txt +++ /dev/null @@ -1,11 +0,0 @@ -Security - * Fix a compliance issue whereby we were not checking the tag on the - algorithm parameters (only the size) when comparing the signature in the - description part of the cert to the real signature. This meant that a - NULL algorithm parameters entry would look identical to an array of REAL - (size zero) to the library and thus the certificate would be considered - valid. However, if the parameters do not match in *any* way then the - certificate should be considered invalid, and indeed OpenSSL marks these - certs as invalid when mbedtls did not. - Many thanks to guidovranken who found this issue via differential fuzzing - and reported it in #3629. diff --git a/ChangeLog.d/zeroizations_of_sensitive_data_in_PKCS5_and_SHA.txt b/ChangeLog.d/zeroizations_of_sensitive_data_in_PKCS5_and_SHA.txt deleted file mode 100644 index 320bb0e86..000000000 --- a/ChangeLog.d/zeroizations_of_sensitive_data_in_PKCS5_and_SHA.txt +++ /dev/null @@ -1,6 +0,0 @@ -Security - * Zeroising of local buffers and variables which are used for calculations - in mbedtls_pkcs5_pbkdf2_hmac(), mbedtls_internal_sha*_process(), - mbedtls_internal_md*_process() and mbedtls_internal_ripemd160_process() - functions to erase sensitive data from memory. Reported by - Johan Malmgren and Johan Uppman Bruce from Sectra.