diff options
author | Matt Caswell <matt@openssl.org> | 2016-01-27 13:41:16 +0000 |
---|---|---|
committer | Matt Caswell <matt@openssl.org> | 2016-01-28 14:41:19 +0000 |
commit | 502bed22a940598bad27555d2b5c5c27a1f2edf1 (patch) | |
tree | e984d245a7106e8a72aa18ff85af9c1ec83b9bc1 /CHANGES | |
parent | e729aac19de7b41169be82e6e55c4c898de9470a (diff) |
CHANGES and NEWS updates for release
Add details about the latest issues fixed in the forthcoming release.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Diffstat (limited to 'CHANGES')
-rw-r--r-- | CHANGES | 46 |
1 files changed, 45 insertions, 1 deletions
@@ -2,7 +2,7 @@ OpenSSL CHANGES _______________ - Changes between 1.0.2e and 1.1.0 [xx XXX xxxx] + Changes between 1.0.2f and 1.1.0 [xx XXX xxxx] *) Removed many obsolete configuration items, including DES_PTR, DES_RISC1, DES_RISC2, DES_INT @@ -720,6 +720,50 @@ whose return value is often ignored. [Steve Henson] + Changes between 1.0.2e and 1.0.2f [28 Jan 2016] + *) DH small subgroups + + Historically OpenSSL only ever generated DH parameters based on "safe" + primes. More recently (in version 1.0.2) support was provided for + generating X9.42 style parameter files such as those required for RFC 5114 + support. The primes used in such files may not be "safe". Where an + application is using DH configured with parameters based on primes that are + not "safe" then an attacker could use this fact to find a peer's private + DH exponent. This attack requires that the attacker complete multiple + handshakes in which the peer uses the same private DH exponent. For example + this could be used to discover a TLS server's private DH exponent if it's + reusing the private DH exponent or it's using a static DH ciphersuite. + + OpenSSL provides the option SSL_OP_SINGLE_DH_USE for ephemeral DH (DHE) in + TLS. It is not on by default. If the option is not set then the server + reuses the same private DH exponent for the life of the server process and + would be vulnerable to this attack. It is believed that many popular + applications do set this option and would therefore not be at risk. + + The fix for this issue adds an additional check where a "q" parameter is + available (as is the case in X9.42 based parameters). This detects the + only known attack, and is the only possible defense for static DH + ciphersuites. This could have some performance impact. + + Additionally the SSL_OP_SINGLE_DH_USE option has been switched on by + default and cannot be disabled. This could have some performance impact. + + This issue was reported to OpenSSL by Antonio Sanso (Adobe). + (CVE-2016-0701) + [Matt Caswell] + + *) SSLv2 doesn't block disabled ciphers + + A malicious client can negotiate SSLv2 ciphers that have been disabled on + the server and complete SSLv2 handshakes even if all SSLv2 ciphers have + been disabled, provided that the SSLv2 protocol was not also disabled via + SSL_OP_NO_SSLv2. + + This issue was reported to OpenSSL on 26th December 2015 by Nimrod Aviram + and Sebastian Schinzel. + (CVE-2015-3197) + [Viktor Dukhovni] + Changes between 1.0.2d and 1.0.2e [3 Dec 2015] *) BN_mod_exp may produce incorrect results on x86_64 |