diff options
author | Matt Caswell <matt@openssl.org> | 2019-09-10 11:51:59 +0100 |
---|---|---|
committer | Matt Caswell <matt@openssl.org> | 2019-09-10 12:08:15 +0100 |
commit | a95b0815c7d2dc0e03875fa553bb8309a206ab0a (patch) | |
tree | b375fec1d3faae6425213d8fa6336f152492ed8b /CHANGES | |
parent | 08229ad838c50f644d7e928e2eef147b4308ad64 (diff) |
Remove duplicate CHANGES entry
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9844)
Diffstat (limited to 'CHANGES')
-rw-r--r-- | CHANGES | 13 |
1 files changed, 1 insertions, 12 deletions
@@ -24,18 +24,6 @@ (CVE-2019-1549) [Matthias St. Pierre] - *) Fixed a padding oracle in PKCS7_decrypt() and CMS_decrypt(). In situations - where an attacker receives automated notification of the success or failure - of a decryption attempt an attacker, after sending a very large number of - messages to be decrypted, can recover a CMS/PKCS7 transported encryption - key or decrypt any RSA encrypted message that was encrypted with the public - RSA key, using a Bleichenbacher padding oracle attack. Applications are not - affected if they use a certificate together with the private RSA key to the - CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info - to decrypt. - (CVE-2019-1563) - [Bernd Edlinger] - *) For built-in EC curves, ensure an EC_GROUP built from the curve name is used even when parsing explicit parameters, when loading a serialized key or calling `EC_GROUP_new_from_ecpkparameters()`/ @@ -66,6 +54,7 @@ certifiate is not given and all recipientInfo are tried out. The old behaviour can be re-enabled in the CMS code by setting the CMS_DEBUG_DECRYPT flag. + (CVE-2019-1563) [Bernd Edlinger] *) Early start up entropy quality from the DEVRANDOM seed source has been |