diff options
| author | Matt Caswell <matt@openssl.org> | 2024-03-05 16:01:20 +0000 |
|---|---|---|
| committer | Tomas Mraz <tomas@openssl.org> | 2024-04-08 12:06:25 +0200 |
| commit | 03c4b0eab6dcbb59e3f58baad634be8fc798c103 (patch) | |
| tree | eda3d818cccbd84a36629ae5b0fe2e57a2df344c /CHANGES.md | |
| parent | 7984fa683e9dfac0cad50ef2a9d5a13330222044 (diff) | |
Add a CHANGES.md/NEWS.md entry for the unbounded memory growth bug
Related to CVE-2024-2511
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24042)
Diffstat (limited to 'CHANGES.md')
| -rw-r--r-- | CHANGES.md | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/CHANGES.md b/CHANGES.md index 559a69f518..8fd34ac467 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -173,6 +173,24 @@ OpenSSL 3.2 ### Changes between 3.2.1 and 3.2.2 [xx XXX xxxx] + * Fixed an issue where some non-default TLS server configurations can cause + unbounded memory growth when processing TLSv1.3 sessions. An attacker may + exploit certain server configurations to trigger unbounded memory growth that + would lead to a Denial of Service + + This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option + is being used (but not if early_data is also configured and the default + anti-replay protection is in use). In this case, under certain conditions, + the session cache can get into an incorrect state and it will fail to flush + properly as it fills. The session cache will continue to grow in an unbounded + manner. A malicious client could deliberately create the scenario for this + failure to force a Denial of Service. It may also happen by accident in + normal operation. + + ([CVE-2024-2511]) + + *Matt Caswell* + * Fixed bug where SSL_export_keying_material() could not be used with QUIC connections. (#23560) @@ -20545,6 +20563,7 @@ ndif <!-- Links --> +[CVE-2024-2511]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-2511 [CVE-2024-0727]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-0727 [CVE-2023-6237]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-6237 [CVE-2023-6129]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-6129 |