From c3e9abedfffc954b9dd68bece97158dd5bfaddda Mon Sep 17 00:00:00 2001 From: Ronald Cron Date: Fri, 17 Jun 2022 17:23:06 +0200 Subject: [PATCH] Add change log Signed-off-by: Ronald Cron --- ChangeLog.d/tls13-fix-key-usage-checks.txt | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 ChangeLog.d/tls13-fix-key-usage-checks.txt diff --git a/ChangeLog.d/tls13-fix-key-usage-checks.txt b/ChangeLog.d/tls13-fix-key-usage-checks.txt new file mode 100644 index 000000000..f19bf523e --- /dev/null +++ b/ChangeLog.d/tls13-fix-key-usage-checks.txt @@ -0,0 +1,7 @@ +Security + * Fix check of certificate key usage in TLS 1.3. The usage of the public key + provided by a client or server certificate for authentication was not + checked properly when validating the certificate. This could cause a + client or server to be able to authenticate itself through a certificate + to an Mbed TLS TLS 1.3 server or client while it does not own a proper + certificate to do so.