commit ee98109af508b14fc79051b263e641a64864bf43
author Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com> Mon Jun 26 11:30:01 2017 +0200
committer Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com> Thu Jul 06 11:58:41 2017 +0200
tree a1f4b62444a80ff2b1a1f56f8470c01a8267bed2
parent 81bb6b6acf0e56f6bb5421440a6363dd2b281a6b

Add ChangeLog entry for the security issue

ChangeLog

diff --git a/ChangeLog b/ChangeLog
index d35457b..038858c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -2,6 +2,14 @@
 
 = mbed TLS 2.y.z released YYYY-MM-DD
 
+Security
+   * Fix authentication bypass in SSL/TLS: when auth_mode is set to optional,
+   mbedtls_ssl_get_verify_result() would incorrectly return 0 when the peer's
+   X.509 certificate chain had more than MBEDTLS_X509_MAX_INTERMEDIATE_CA
+   (default: 8) intermediates, even when it was not trusted. Could be
+   trigerred remotely on both sides. (With auth_mode set to required
+   (default), the handshake was correctly aborted.)
+
 Changes
    * Certificate verification functions now set flags to -1 in case the full
      chain was not verified due to an internal error (including in the verify