Add ChangeLog

Signed-off-by: Ben Taylor <[email protected]>
2026-09-26 03:57:26 +00:00 · 2026-06-11 16:24:04 +01:00
parent 5fa28bb6cd
commit e9332e8ebe
1 changed files with 6 additions and 0 deletions
@@ -0,0 +1,6 @@
+Security
+   * Fix a potential information disclosure in TLS 1.2 servers using session
+     tickets. If the session ticket write callback failed without setting the
+     lifetime output parameter, Mbed TLS could send 4 bytes of uninitialized
+     stack memory to the peer in the NewSessionTicket message. Fixes #1570.
+     Reported by James Love. CVE-2026-50586.