diff options
| author | Dr. Stephen Henson <steve@openssl.org> | 2014-06-05 09:08:27 +0100 |
|---|---|---|
| committer | Dr. Stephen Henson <steve@openssl.org> | 2014-06-05 09:08:27 +0100 |
| commit | bb598893057e4b5fd789b36005b31dfd57011aa8 (patch) | |
| tree | 6020bc878dd687c1f919981c4d5032c22be5ff20 | |
| parent | 141a5482fdd1944804cc342c1c443362eed8501b (diff) | |
Update CHANGES and NEWS
| -rw-r--r-- | CHANGES | 31 | ||||
| -rw-r--r-- | NEWS | 5 |
2 files changed, 36 insertions, 0 deletions
@@ -4,6 +4,37 @@ Changes between 0.9.8y and 0.9.8za [xx XXX xxxx] + *) Fix for SSL/TLS MITM flaw. An attacker using a carefully crafted + handshake can force the use of weak keying material in OpenSSL + SSL/TLS clients and servers. + + Thanks to KIKUCHI Masashi (Lepidum Co. Ltd.) for discovering and + researching this issue. (CVE-2014-0224) + [KIKUCHI Masashi, Steve Henson] + + *) Fix DTLS recursion flaw. By sending an invalid DTLS handshake to an + OpenSSL DTLS client the code can be made to recurse eventually crashing + in a DoS attack. + + Thanks to Imre Rad (Search-Lab Ltd.) for discovering this issue. + (CVE-2014-0221) + [Imre Rad, Steve Henson] + + *) Fix DTLS invalid fragment vulnerability. A buffer overrun attack can + be triggered by sending invalid DTLS fragments to an OpenSSL DTLS + client or server. This is potentially exploitable to run arbitrary + code on a vulnerable client or server. + + Thanks to Jüri Aedla for reporting this issue. (CVE-2014-0195) + [Jüri Aedla, Steve Henson] + + *) Fix bug in TLS code where clients enable anonymous ECDH ciphersuites + are subject to a denial of service attack. + + Thanks to Felix Gröbert and Ivan Fratric at Google for discovering + this issue. (CVE-2014-3470) + [Felix Gröbert, Ivan Fratric, Steve Henson] + *) Fix for the attack described in the paper "Recovering OpenSSL ECDSA Nonces Using the FLUSH+RELOAD Cache Side-channel Attack" by Yuval Yarom and Naomi Benger. Details can be obtained from: @@ -7,7 +7,12 @@ Major changes between OpenSSL 0.9.8y and OpenSSL 0.9.8za [under development]: + o Fix for CVE-2014-0224 + o Fix for CVE-2014-0221 + o Fix for CVE-2014-0195 + o Fix for CVE-2014-3470 o Fix for CVE-2014-0076 + o Fix for CVE-2010-5298 o Fix to TLS alert handling. Major changes between OpenSSL 0.9.8x and OpenSSL 0.9.8y [5 Feb 2013]: |