From 63ea5aef99b54b687fdc62a40a06955ed35dda9e Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Mon, 22 Jun 2026 22:29:15 +0100 Subject: [PATCH 1/6] Added CVE Signed-off-by: Minos Galanakis --- ChangeLog.d/tls13-hrr-selected-group.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog.d/tls13-hrr-selected-group.txt b/ChangeLog.d/tls13-hrr-selected-group.txt index 20d7a18fbd..c318b393fc 100644 --- a/ChangeLog.d/tls13-hrr-selected-group.txt +++ b/ChangeLog.d/tls13-hrr-selected-group.txt @@ -2,4 +2,4 @@ Security * Fix TLS 1.3 clients to reject a HelloRetryRequest whose selected group was not advertised in the original ClientHello. Reported by Din Asotić / Xiangdong Li, Beijing University of Posts and - Telecommunications (BUPT) + Telecommunications (BUPT). CVE-2026-25832 From 091ce71fb296f0b6ca40f97e368e9df31eb73463 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Mon, 22 Jun 2026 22:32:25 +0100 Subject: [PATCH 2/6] Added attribution Signed-off-by: Minos Galanakis --- ChangeLog.d/tls13-hrr-selected-group.txt | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/ChangeLog.d/tls13-hrr-selected-group.txt b/ChangeLog.d/tls13-hrr-selected-group.txt index c318b393fc..4c338480f6 100644 --- a/ChangeLog.d/tls13-hrr-selected-group.txt +++ b/ChangeLog.d/tls13-hrr-selected-group.txt @@ -1,5 +1,7 @@ Security * Fix TLS 1.3 clients to reject a HelloRetryRequest whose selected group was - not advertised in the original ClientHello. Reported by + not advertised in the original ClientHello. Reported independently by Din Asotić / Xiangdong Li, Beijing University of Posts and - Telecommunications (BUPT). CVE-2026-25832 + Telecommunications (BUPT), and NVIDIA Project Vanessa. + CVE-2026-25832. + From 5d39fcb958637bada6316a764bdf1c685ddb930e Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Wed, 24 Jun 2026 14:36:00 +0100 Subject: [PATCH 3/6] Changelog. Added attribution/CVE for 1569 Signed-off-by: Minos Galanakis --- ChangeLog.d/security-issue1569.txt | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ChangeLog.d/security-issue1569.txt b/ChangeLog.d/security-issue1569.txt index c7d3ca0782..c9e285b80e 100644 --- a/ChangeLog.d/security-issue1569.txt +++ b/ChangeLog.d/security-issue1569.txt @@ -1,4 +1,7 @@ Security * Improved documentation of mbedtls_ssl_conf_sig_algs() to emphasize that this function only sets signature algorithms that are enforced during - TLS key exchange and not on certificate verification. + TLS key exchange and not on certificate verification. Reported by + Xiangdong Li, Beijing University of Posts and Telecommunications (BUPT). + CVE-2026-54441 + From 2018448bfe9425ccd80f984570c2d19d525875f0 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Wed, 24 Jun 2026 15:28:12 +0100 Subject: [PATCH 4/6] Changelog: Added cve/attrib issue 1506 Signed-off-by: Minos Galanakis --- ChangeLog.d/ecp-modp-side-channel.txt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ChangeLog.d/ecp-modp-side-channel.txt b/ChangeLog.d/ecp-modp-side-channel.txt index 83645e5741..591abd8203 100644 --- a/ChangeLog.d/ecp-modp-side-channel.txt +++ b/ChangeLog.d/ecp-modp-side-channel.txt @@ -2,4 +2,5 @@ Security * Fix a side channel in ECC computations that allows a powerful local attacker (typically, untrusted OS attacking a secure enclave) to fully recover long-term secret keys. Found and reported by Alejandro Cabrera - Aldaya from Tampere University. + Aldaya from Tampere University. CVE-2026-54435 + From dccf53b9a57b81196b1774c3164900ac34870b7f Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Wed, 24 Jun 2026 15:29:13 +0100 Subject: [PATCH 5/6] Changelog: Added cve/attrib issue 67 Signed-off-by: Minos Galanakis --- ChangeLog.d/mbedtls_pk_ecc_set_pubkey.txt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ChangeLog.d/mbedtls_pk_ecc_set_pubkey.txt b/ChangeLog.d/mbedtls_pk_ecc_set_pubkey.txt index 44906298da..56020af2f7 100644 --- a/ChangeLog.d/mbedtls_pk_ecc_set_pubkey.txt +++ b/ChangeLog.d/mbedtls_pk_ecc_set_pubkey.txt @@ -1,3 +1,4 @@ Security * Fix a 1-byte buffer overread when parsing a malformed ECC public key - in the PK module. + in the PK module. CVE-2026-50583 + From 677ed44d5ee90a0042a7438156a229e1bb59fce0 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Thu, 25 Jun 2026 10:16:13 +0100 Subject: [PATCH 6/6] Added attribution to chacha20-counter-overflow.txt Signed-off-by: Minos Galanakis --- ChangeLog.d/chacha20-counter-overflow.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog.d/chacha20-counter-overflow.txt b/ChangeLog.d/chacha20-counter-overflow.txt index 0d824d6a9c..dfdac507df 100644 --- a/ChangeLog.d/chacha20-counter-overflow.txt +++ b/ChangeLog.d/chacha20-counter-overflow.txt @@ -1,4 +1,4 @@ Security * Reject ChaCha20 operations that would make the 32-bit block counter wrap around, which could otherwise reuse keystream and compromise - confidentiality. CVE-2026-50584 + confidentiality. Reported by jiliang. CVE-2026-50584