diff options
| author | Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk> | 2017-09-01 19:04:29 +0100 |
|---|---|---|
| committer | Stijn Tintel <stijn@linux-ipv6.be> | 2017-09-11 01:56:14 +0200 |
| commit | 69ac637fbbc3fedb7fd9bd12cddd47b1e3875766 (patch) | |
| tree | 94d71ee7e9b4905d6a404d6feea010407ab5fcf2 /config | |
| parent | 21014d9708d586becbd62da571effadb488da9fc (diff) | |
| download | upstream-69ac637fbbc3fedb7fd9bd12cddd47b1e3875766.tar.gz upstream-69ac637fbbc3fedb7fd9bd12cddd47b1e3875766.tar.bz2 upstream-69ac637fbbc3fedb7fd9bd12cddd47b1e3875766.zip | |
mbedtls: update to 2.6.0 CVE-2017-14032
Fixed an authentication bypass issue in SSL/TLS. When the TLS
authentication mode was set to 'optional',
mbedtls_ssl_get_verify_result() would incorrectly return 0 when the
peer's X.509 certificate chain had more than
MBEDTLS_X509_MAX_INTERMEDIATE_CA intermediates (default: 8), even when
it was not trusted. This could be triggered remotely on both the client
and server side. (Note, with the authentication mode set by
mbedtls_ssl_conf_authmode()to be 'required' (the default), the handshake
was correctly aborted).
Signed-off-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
Tested-by: Magnus Kroken <mkroken@gmail.com>
Diffstat (limited to 'config')
0 files changed, 0 insertions, 0 deletions