Merge fix for IOTSSL-474 PKCS12 Overflow
Fix stack buffer overflow in PKCS12
diff --git a/ChangeLog b/ChangeLog
index e024af8..f60dcb3 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -4,10 +4,13 @@
Security
* Added fix for CVE-2015-xxxxx to prevent heap corruption due to buffer
- overflow of the hostname or session ticket. (Found by Guido Vranken).
+ overflow of the hostname or session ticket. Found by Guido Vranken.
* Fix potential double-free if mbedtls_ssl_set_hs_psk() is called more than
once in the same handhake and mbedtls_ssl_conf_psk() was used.
Found and patch provided by Guido Vranken. Cannot be forced remotely.
+ * Fix stack buffer overflow in pkcs12 decryption (used by
+ mbedtls_pk_parse_key(file)() when the password is > 129 bytes.
+ Found by Guido Vranken. Not triggerable remotely.
Changes
* Added checking of hostname length in mbedtls_ssl_set_hostname() to ensure