yuzu-emu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2024-11-22 12:05:36 +01:00
Code Issues Packages Projects Releases Wiki Activity

Prevent SLOTH attacks

Browse Source
This commit is contained in:
Janos Follath 2016-10-25 10:50:22 +01:00 committed by Simon Butcher
parent 0eced5aae5
commit 182013faf4
2 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
ChangeLog
View File

@ -2,6 +2,10 @@ mbed TLS ChangeLog (Sorted per branch, date)
= mbed TLS 2.x.x branch released xxxx-xx-xx = mbed TLS 2.x.x branch released xxxx-xx-xx
Security
* Removed MD5 from the allowed hash algorithms for CertificateRequest and
CertificateVerify messages, to prevent SLOTH attacks against TLS 1.2.
Bugfix Bugfix
* Fix the redefinition of macro ssl_set_bio to an undefined symbol * Fix the redefinition of macro ssl_set_bio to an undefined symbol
mbedtls_ssl_set_bio_timeout in compat-1.3.h, by removing it. mbedtls_ssl_set_bio_timeout in compat-1.3.h, by removing it.

3
library/ssl_tls.c
View File

@ -7653,8 +7653,7 @@ int mbedtls_ssl_set_calc_verify_md( mbedtls_ssl_context *ssl, int md )
#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
#if defined(MBEDTLS_MD5_C) #if defined(MBEDTLS_MD5_C)
case MBEDTLS_SSL_HASH_MD5: case MBEDTLS_SSL_HASH_MD5:
ssl->handshake->calc_verify = ssl_calc_verify_tls; return MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH;
break;
#endif #endif
#if defined(MBEDTLS_SHA1_C) #if defined(MBEDTLS_SHA1_C)
case MBEDTLS_SSL_HASH_SHA1: case MBEDTLS_SSL_HASH_SHA1: