diff options
| author | Matt Caswell <matt@openssl.org> | 2024-03-05 16:01:20 +0000 |
|---|---|---|
| committer | Tomas Mraz <tomas@openssl.org> | 2024-04-08 12:07:41 +0200 |
| commit | 16e2b1080aae827878315dc7124d471d24c80783 (patch) | |
| tree | b76a28bc8aabe985275c8bf6b94045ee755b5095 /NEWS.md | |
| parent | d30922ad15a61815b568b684b685d0afa54f1679 (diff) | |
Add a CHANGES.md/NEWS.md entry for the unbounded memory growth bug
Related to CVE-2024-2511
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24042)
(cherry picked from commit 03c4b0eab6dcbb59e3f58baad634be8fc798c103)
Diffstat (limited to 'NEWS.md')
| -rw-r--r-- | NEWS.md | 13 |
1 files changed, 12 insertions, 1 deletions
@@ -140,7 +140,17 @@ tracker][issue tracker]. OpenSSL 3.2 ----------- -### Major changes between OpenSSL 3.2.0 and OpenSSL 3.2.1 [under development] +### Major changes between OpenSSL 3.2.1 and OpenSSL 3.2.2 [under development] + +OpenSSL 3.2.2 is a security patch release. The most severe CVE fixed in this +release is Low. + +This release incorporates the following bug fixes and mitigations: + + * Fixed unbounded memory growth with session handling in TLSv1.3 + ([CVE-2024-2511]) + +### Major changes between OpenSSL 3.2.0 and OpenSSL 3.2.1 [30 Jan 2024] OpenSSL 3.2.1 is a security patch release. The most severe CVE fixed in this release is Low. @@ -1703,6 +1713,7 @@ OpenSSL 0.9.x <!-- Links --> +[CVE-2024-2511]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-2511 [CVE-2024-0727]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-0727 [CVE-2023-6237]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-6237 [CVE-2023-6129]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-6129 |