RSA PKCS1v1.5 verification: check padding length
The test case was generated by modifying our signature code so that it
produces a 7-byte long padding (which also means garbage at the end, so it is
essential to check that the error that is detected first is indeed the
padding rather than the final length check).
diff --git a/ChangeLog b/ChangeLog
index fe5ce65..9ed4e5b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,11 @@
mbed TLS ChangeLog (Sorted per branch, date)
+= mbed TLS 2.1.x branch released xxxx-xx-xx
+
+Security
+ * Tighten parsing of RSA PKCS#1 v1.5 signatures, to avoid a
+ potential Bleichenbacher/BERserk-style attack.
+
= mbed TLS 2.1.7 branch released 2017-03-08
Security