diff options
author | Matt Caswell <matt@openssl.org> | 2014-10-15 10:50:25 +0100 |
---|---|---|
committer | Geoff Thorpe <geoff@openssl.org> | 2014-10-15 08:49:50 -0400 |
commit | 6469c947f5536ec5d0ac7432cc46d55bd0dac2f8 (patch) | |
tree | a7b7c7f3f3c67b0148f372f1762704e7f5602ad9 | |
parent | 9bf3ff1ca06e1bc8bd0c0cc52a9b92ac20f21c83 (diff) |
Update to CHANGES file
Reviewed-by: Bodo Möller <bodo@openssl.org>
-rw-r--r-- | CHANGES | 19 |
1 files changed, 19 insertions, 0 deletions
@@ -4,6 +4,25 @@ Changes between 1.0.0n and 1.0.0o [xx XXX xxxx] + *) Session Ticket Memory Leak. + + When an OpenSSL SSL/TLS/DTLS server receives a session ticket the + integrity of that ticket is first verified. In the event of a session + ticket integrity check failing, OpenSSL will fail to free memory + causing a memory leak. By sending a large number of invalid session + tickets an attacker could exploit this issue in a Denial Of Service + attack. + (CVE-2014-3567) + [Steve Henson] + + *) Build option no-ssl3 is incomplete. + + When OpenSSL is configured with "no-ssl3" as a build option, servers + could accept and complete a SSL 3.0 handshake, and clients could be + configured to send them. + (CVE-2014-3568) + [Akamai and the OpenSSL team] + *) Add support for TLS_FALLBACK_SCSV. Client applications doing fallback retries should call SSL_set_mode(s, SSL_MODE_SEND_FALLBACK_SCSV). |