s2n Files

Release Summary

• Add pure MLKEM1024 to AWS-CRT-SDK PQ policies

What's Changed

• chore: use s2n_add_overflow for arithmetics in s2n_server_key_exchange.c by @boquan-fang in https://github.com/aws/s2n-tls/pull/5809
• fix: explicit size checks in s2n_connection_set_session by @boquan-fang in https://github.com/aws/s2n-tls/pull/5812
• chore: bindings release 0.3.36 by @jouho in https://github.com/aws/s2n-tls/pull/5814
• fix: add non-negative length check in s2n_utf8_string_from_extension_data by @jouho in https://github.com/aws/s2n-tls/pull/5816
• fix: zero the blob in s2n_free_without_wipe before invoking callback by @boquan-fang in https://github.com/aws/s2n-tls/pull/5811
• fix: add NULL check for X509_STORE_new() in s2n_x509_trust_store_add_pem by @jouho in https://github.com/aws/s2n-tls/pull/5817
• fix: validate ML-DSA key type by @CarolYeh910 in https://github.com/aws/s2n-tls/pull/5772
• fix: use uint32_t for partial_client_hello_size to prevent truncation by @mizunoyuuki in https://github.com/aws/s2n-tls/pull/5808
• build(deps): bump aws-actions/configure-aws-credentials from 6.0.0 to 6.1.0 in /.github/workflows in the all-gha-updates group by @dependabot[bot] in https://github.com/aws/s2n-tls/pull/5820
• fix: pin aws crt cpp to resolve general batch failures by @kaukabrizvi in https://github.com/aws/s2n-tls/pull/5822
• fix: enforce DH public key range by @jouho in https://github.com/aws/s2n-tls/pull/5818
• build(deps): bump cross-platform-actions/action from 0.32.0 to 1.0.0 in /.github/workflows in the all-gha-updates group by @dependabot[bot] in https://github.com/aws/s2n-tls/pull/5824
• feat(metrics): add compatibility metrics by @jmayclin in https://github.com/aws/s2n-tls/pull/5823
• revert: "fix: pin aws crt cpp to resolve general batch failures" by @kaukabrizvi in https://github.com/aws/s2n-tls/pull/5827
• fix: unchecked NULL return from X509_EXTENSION_get_data by @boquan-fang in https://github.com/aws/s2n-tls/pull/5825
• refactor(metrics-subscriber): simplify per-resource export flow by @kaukabrizvi in https://github.com/aws/s2n-tls/pull/5786
• chore: release metrics subscriber v0.0.2 by @kaukabrizvi in https://github.com/aws/s2n-tls/pull/5828
• ci: disable go when build awslc by @boquan-fang in https://github.com/aws/s2n-tls/pull/5833
• style(bindings): standardize doc links to monospaced format by @mvanhorn in https://github.com/aws/s2n-tls/pull/5791
• fix: typos in s2n-tls codebase by @boquan-fang in https://github.com/aws/s2n-tls/pull/5835
• ci: fix failed renegotiation tests in the Rust bindings by @CarolYeh910 in https://github.com/aws/s2n-tls/pull/5837
• build(deps): update s2n-codec requirement from 0.77 to 0.78 in /bindings/rust/standard by @dependabot[bot] in https://github.com/aws/s2n-tls/pull/5839
• fix: cleanup kem public key in failure case by @jmayclin in https://github.com/aws/s2n-tls/pull/5841
• ci: accept 400 from ebay.com in https_client network test by @kaukabrizvi in https://github.com/aws/s2n-tls/pull/5853
• fix: enable FIPS mode with validated 3+ providers and OpenSSL 3.5+ by @xnox in https://github.com/aws/s2n-tls/pull/5840
• fix: make get_handshake_type_name procotol aware by @jmayclin in https://github.com/aws/s2n-tls/pull/5843
• feat(metrics-subscriber): extract cert parameters from der by @jmayclin in https://github.com/aws/s2n-tls/pull/5838
• feat: add pure mlkem1024 to CRT PQ policies by @CarolYeh910 in https://github.com/aws/s2n-tls/pull/5830
• docs: clarify OCSP_basic_verify() behavior on delegated responder certs by @CarolYeh910 in https://github.com/aws/s2n-tls/pull/5859
• test: Cert retrieval behavior in Rust bindings by @maddeleine in https://github.com/aws/s2n-tls/pull/5857
• chore: bump MSRV by @jmayclin in https://github.com/aws/s2n-tls/pull/5862

New Contributors

• @mizunoyuuki made their first contribution in https://github.com/aws/s2n-tls/pull/5808
• @mvanhorn made their first contribution in https://github.com/aws/s2n-tls/pull/5791
• @xnox made their first contribution in https://github.com/aws/s2n-tls/pull/5840

Full Changelog: https://github.com/aws/s2n-tls/compare/v1.7.2...v1.7.3