mirror of
https://github.com/stefanberger/libtpms
synced 2025-08-23 16:01:32 +00:00
118 lines
5.0 KiB
Plaintext
118 lines
5.0 KiB
Plaintext
CHANGES - changes for libtpms
|
|
|
|
version 0.9.7:
|
|
- tpm2: Fix potential out-of-bound access & abort due to HMAC signing issue (CVE-2025-49133)
|
|
- tpm2: Remove assigned-to value to offset because it is unused (Coverity)
|
|
- tpm2: Insert assert ensuring *buflen != BUFLEN_EMPTY_BUFFER (Coverity)
|
|
- tpm2: Address Coverity Issue by casting '1' before shift (CID 1470813)
|
|
- tpm2: Filter bad input values to avoid underflow in FindNthSetBit (Coverity)
|
|
- tpm2: Address a possible unsigned integer underflow (Coverity)
|
|
- tpm2: Remove assigned to value to offset because it is unused (Coverity)
|
|
- tpm2: Initialize eccPublic before passing to TPMS_ECC_POINT_Unmarshal (Coverity)
|
|
- tpm2: Preserve more *target and restore them if needed (Coverity)
|
|
- tpm2: Return TPM_RC_VALUE upon decryption failure
|
|
- tpm12: Replace include of engine.h with err.h
|
|
- tpm2: Fix issue in CryptParameterEncryption() (TPM 2 errata v1.4)
|
|
- tpm2: Sync fix in TPM2_PolicyAuthorize() with upstream
|
|
- tpm2: Sync CryptParameterDecrypt implementation with upstream
|
|
- tpm2: Fix issue related to CryptGenerateKeyDes (TPM 2 errata v1.4)
|
|
- tpm2: Check size of TPM2B_NAME buffer before reading 2 bytes from it
|
|
|
|
version 0.9.6:
|
|
- tpm2: Check size of buffer before accessing it (CVE-2023-1017 & -1018)
|
|
|
|
version 0.9.5:
|
|
- tpm2: Do not set RSA_FLAG_NO_BLINDING on RSA keys anymore
|
|
- tpm2: Fix a potential overflow expression (coverity)
|
|
- tpm2: Fix size check in CryptSecretDecrypt
|
|
|
|
version 0.9.4:
|
|
- tpm: #undef printf in case it is #define'd (OSS-Fuzz)
|
|
- tpm2: Check return code of BN_div()
|
|
- tpm2: Initialize variables due to gcc complaint (s390x, false positive)
|
|
- tpm12: Initialize variables due to gcc complaint (s390x, false positive)
|
|
- build-sys: Fix configure script to support _FORTIFY_SOURCE=3
|
|
|
|
version 0.9.3:
|
|
- build-sys: Add probing for -fstack-protector
|
|
- tpm2: Do not call EVP_PKEY_CTX_set0_rsa_oaep_label() for label of size
|
|
(OSSL 3)
|
|
|
|
version 0.9.2:
|
|
- tpm2: When writing state initialize s_ContextSlotMask if not set
|
|
|
|
version 0.9.1:
|
|
- tpm2: Do not write permanent state if only clock changed
|
|
- tpm2: Fix "maybe-uninitialized" warning
|
|
|
|
version 0.9.0:
|
|
- NOTE: Downgrade to previous versions is not possible. See below.
|
|
- The size of the context gap has been adjusted to 0xffff from 0xff.
|
|
As a consequence of this the volatile state's format (STATE_RESET_DATA)
|
|
has changed and cannot be downgraded.
|
|
- Applied work-around for Win 2016 & 2019 server related to
|
|
TPM2_ContextLoad (issue #217)
|
|
- Check for several more compile-time constants
|
|
- Enabled Camellia symmetric key encryption algorithm
|
|
- tpm2: CryptSym: fix AES output IV
|
|
- tpm2: Added a cache for private exponent D and prime Q
|
|
- tpm2: bug fixes related to state marshalling
|
|
- tpm2: Consume padding bytes in TPM2_ContextLoad() (Win2k19, issue #217)
|
|
- tests: Improvements on the fuzzer
|
|
- tpm2: Switch to UINT16 for CONTEXT_SLOT and 64k context gap
|
|
- tpm2: Update to TPM 2 spec rev 164
|
|
- build-sys: Enable building --without-tpm1
|
|
- tpm2: Marshal event sequence objects' hash state
|
|
- tpm2: Fixes for build and runtime when using OpenSSL 3.0
|
|
|
|
version 0.8.0
|
|
- NOTE: Downgrade to previous versions is not possible. See below.
|
|
- Update to TPM 2 code release 159
|
|
- X509 support is enabled
|
|
- SM2 signing of ceritificates is NOT supported
|
|
- Authenticated timers are disabled
|
|
- Due to fixes in the TPM 2 prime number generation code in rev155 it is not
|
|
possible to downgrade from libtpms version 0.8.0 to some previous version.
|
|
The seeds are now associated with an age so that older seeds use the old
|
|
TPM 2 prime number generation code while newer seed use the newer code.
|
|
- Update to TPM 2 code release 162
|
|
- ECC encryption / decryption is disabled
|
|
- Fix support for elliptic curve due to missing unmarshalling code
|
|
- Runtime filter supported elliptic curves supported by OpenSSL
|
|
- Fix output buffer parameter and size for RSA decryption that could cause
|
|
stack corruption under certain circumstances
|
|
- Set the RSA PSS salt length to the digest length rather than max. possible
|
|
- Fixes to symmetric decryption related to input size check,
|
|
defer padding to the user [EVP_CIPHER_CTX_set_padding(ctx, 0)] and
|
|
to always use a temporary malloc'ed buffer for decryption
|
|
- Fixed the set of PCRs belonging to the TCB group. This affects the
|
|
pcrUpdateCounter in TPM2_Pcrread() responses, thus needs latest `swtpm`
|
|
for test cases to succeed there.
|
|
|
|
version 0.7.0
|
|
- use OpenSSL crypto for AES, TDES, EC, and RSA operations when possible
|
|
|
|
version 0.6.0
|
|
- added TPM 2 support (revision 150)
|
|
|
|
- New API calls:
|
|
- TPMLIB_CancelCommand
|
|
- TPMLIB_ChooseTPMVersion
|
|
- TPMLIB_SetDebugFD
|
|
- TPMLIB_SetDebugLevel
|
|
- TPMLIB_SetDebugPrefix
|
|
- TPMLIB_SetBufferSize
|
|
- TPMLIB_ValidateState
|
|
- TPMLIB_SetState
|
|
- TPMLIB_GetState
|
|
|
|
version 0.5.1
|
|
first public release
|
|
|
|
- release 7 increased NVRAM area for being able to store more data in
|
|
the TPM's NVRAM areas, i.e., X.509 certificates
|
|
|
|
- release 9 added two more APIs:
|
|
- TPM_Free
|
|
- TPMLIB_DecodeBlob
|