diff options
author | Bodo Möller <bodo@openssl.org> | 2011-02-08 19:08:32 +0000 |
---|---|---|
committer | Bodo Möller <bodo@openssl.org> | 2011-02-08 19:08:32 +0000 |
commit | cd77b3e88b81e9a432dd3e5cc0811e350b23599a (patch) | |
tree | 1c66157a5bf2cbadb81869db93430d6b9349a2f7 /CHANGES | |
parent | 8c93c4dd42e65ef907d012d7be304cec5d2faa12 (diff) |
Sync with 1.0.0 branch.
(CVE-2011-0014 OCSP stapling fix has been applied to the 1.0.1 branch as well.)
Diffstat (limited to 'CHANGES')
-rw-r--r-- | CHANGES | 32 |
1 files changed, 29 insertions, 3 deletions
@@ -2,7 +2,7 @@ OpenSSL CHANGES _______________ - Changes between 1.0.0c and 1.0.1 [xx XXX xxxx] + Changes between 1.0.0d and 1.0.1 [xx XXX xxxx] *) Add functions to copy EVP_PKEY_METHOD and retrieve flags and id. [Steve Henson] @@ -41,7 +41,10 @@ Add command line options to s_client/s_server. [Steve Henson] - Changes between 1.0.0c and 1.0.0d [xx XXX xxxx] + Changes between 1.0.0c and 1.0.0d [8 Feb 2011] + + *) Fix parsing of OCSP stapling ClientHello extension. CVE-2011-0014 + [Neel Mehta, Adam Langley, Bodo Moeller (Google)] *) Fix bug in string printing code: if *any* escaping is enabled we must escape the escape character (backslash) or the resulting string is @@ -918,11 +921,34 @@ *) Change 'Configure' script to enable Camellia by default. [NTT] - Changes between 0.9.8o and 0.9.8p [xx XXX xxxx] + Changes between 0.9.8q and 0.9.8r [8 Feb 2011] + + *) Fix parsing of OCSP stapling ClientHello extension. CVE-2011-0014 + [Neel Mehta, Adam Langley, Bodo Moeller (Google)] + + *) Fix bug in string printing code: if *any* escaping is enabled we must + escape the escape character (backslash) or the resulting string is + ambiguous. + [Steve Henson] + + Changes between 0.9.8p and 0.9.8q [2 Dec 2010] + + *) Disable code workaround for ancient and obsolete Netscape browsers + and servers: an attacker can use it in a ciphersuite downgrade attack. + Thanks to Martin Rex for discovering this bug. CVE-2010-4180 + [Steve Henson] + + *) Fixed J-PAKE implementation error, originally discovered by + Sebastien Martini, further info and confirmation from Stefan + Arentz and Feng Hao. Note that this fix is a security fix. CVE-2010-4252 + [Ben Laurie] + + Changes between 0.9.8o and 0.9.8p [16 Nov 2010] *) Fix extension code to avoid race conditions which can result in a buffer overrun vulnerability: resumed sessions must not be modified as they can be shared by multiple threads. CVE-2010-3864 + [Steve Henson] *) Fix for double free bug in ssl/s3_clnt.c CVE-2010-2939 [Steve Henson] |