]> git.kaiwu.me - haproxy.git/commit
projects / haproxy.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 4ddf219) | patch
MINOR: ssl: cleanse TLS ticket keys before freeing
authorWilliam Lallemand <wlallemand@irq6.net>
Fri, 25 Sep 2026 08:01:03 +0000 (08:01 +0000)
committerWilliam Lallemand <wlallemand@irq6.net>
Fri, 25 Sep 2026 08:45:00 +0000 (10:45 +0200)
commite06fd5f8a8ad44a776c3dea9e8111bab1e2e693a
treea96d697d5ce49685237e1023106c332e962786c0tree | snapshot
parent4ddf219bb399334e00a0b9af2b155884befd4b04commit | diff
MINOR: ssl: cleanse TLS ticket keys before freeing

Cleanse tlskeys with ha_memset_s() before freeing.

tlskeys contains tls_sess_key structures holding encryption keys for
session resumption. Leaving these secrets in freed heap memory risks
exposure through core dumps or memory disclosure bugs.

This patch cleanses intermediate buffers used to parse the tlskeys as
well.

This fixes issue #3504.
src/cfgparse-ssl.c diff | blob | history
src/ssl_sock.c diff | blob | history
haproxy upstream