diff options
| author | Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk> | 2017-09-01 19:04:29 +0100 |
|---|---|---|
| committer | Hauke Mehrtens <hauke@hauke-m.de> | 2017-09-30 15:24:52 +0200 |
| commit | e232c6754d6e0cbde3892aa1fa243f4707d7ad5e (patch) | |
| tree | b1ca7dd75254adc9e8074c44419e41c0f26d473f /package/network | |
| parent | 37e1bd27d0e8a5dbc4074aa8c8d2dde26b77fb0d (diff) | |
| download | upstream-e232c6754d6e0cbde3892aa1fa243f4707d7ad5e.tar.gz upstream-e232c6754d6e0cbde3892aa1fa243f4707d7ad5e.tar.bz2 upstream-e232c6754d6e0cbde3892aa1fa243f4707d7ad5e.zip | |
mbedtls: update to 2.6.0 CVE-2017-14032
Fixed an authentication bypass issue in SSL/TLS. When the TLS
authentication mode was set to 'optional',
mbedtls_ssl_get_verify_result() would incorrectly return 0 when the
peer's X.509 certificate chain had more than
MBEDTLS_X509_MAX_INTERMEDIATE_CA intermediates (default: 8), even when
it was not trusted. This could be triggered remotely on both the client
and server side. (Note, with the authentication mode set by
mbedtls_ssl_conf_authmode()to be 'required' (the default), the handshake
was correctly aborted).
Signed-off-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
Tested-by: Magnus Kroken <mkroken@gmail.com>
Diffstat (limited to 'package/network')
0 files changed, 0 insertions, 0 deletions