summaryrefslogtreecommitdiffstats
path: root/NEWS.md
AgeCommit message (Collapse)Author
2023-07-14Add a NEWS entry covering the FIPS related changes.Pauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/21386) (cherry picked from commit dfc4b6c93b99f6666cd958c5643a24bb6edff7b7)
2023-07-06Enable QUIC by defaultMatt Caswell
Ensure builds enable QUIC without explicitly having to ask for it. To disable QUIC pass "no-quic" to Configure. As a result we can remove all use of "enable-quic" from the various CI runs. We also add a CHANGES and NEWS entry for QUIC support. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21332)
2023-06-15Fix typos found by codespellDimitri Papadopoulos
Typos in doc/man* will be fixed in a different commit. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20910)
2023-06-06Restrict the size of OBJECT IDENTIFIERs that OBJ_obj2txt will translateRichard Levitte
OBJ_obj2txt() would translate any size OBJECT IDENTIFIER to canonical numeric text form. For gigantic sub-identifiers, this would take a very long time, the time complexity being O(n^2) where n is the size of that sub-identifier. To mitigate this, a restriction on the size that OBJ_obj2txt() will translate to canonical numeric text form is added, based on RFC 2578 (STD 58), which says this: > 3.5. OBJECT IDENTIFIER values > > An OBJECT IDENTIFIER value is an ordered list of non-negative numbers. > For the SMIv2, each number in the list is referred to as a sub-identifier, > there are at most 128 sub-identifiers in a value, and each sub-identifier > has a maximum value of 2^32-1 (4294967295 decimal). Fixes otc/security#96 Fixes CVE-2023-2650 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org>
2023-04-20aesv8-armx.pl: Avoid buffer overrread in AES-XTS decryptionTomas Mraz
Original author: Nevine Ebeid (Amazon) Fixes: CVE-2023-1255 The buffer overread happens on decrypts of 4 mod 5 sizes. Unless the memory just after the buffer is unmapped this is harmless. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/20759)
2023-03-28RFC7250 (RPK) supportTodd Short
Add support for the RFC7250 certificate-type extensions. Alows the use of only private keys for connection (i.e. certs not needed). Add APIs Add unit tests Add documentation Add s_client/s_server support Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18185)
2023-03-28Fix documentation of X509_VERIFY_PARAM_add0_policy()Tomas Mraz
The function was incorrectly documented as enabling policy checking. Fixes: CVE-2023-0466 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20561)
2023-03-28Updated CHANGES.md and NEWS.md for CVE-2023-0465Matt Caswell
Also updated the entries for CVE-2023-0464 Related-to: CVE-2023-0465 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20585)
2023-02-24first cut at sigalg loadingMichael Baentsch
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19312)
2023-02-11Correct a copy&paste error in a link URLTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20228)
2023-02-11Sync CHANGES.md and NEWS.md with 3.0.8 releaseTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20228)
2022-12-05Sync CHANGES.md and NEWS.md with 3.1 releaseTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19808)
2022-11-22Update CHANGES.md and NEWS.md from 3.0.7Tomas Mraz
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19565)
2022-10-18Add support for compressed certificates (RFC8879)Todd Short
* Compressed Certificate extension (server/client) * Server certificates (send/receive) * Client certificate (send/receive) Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18186)
2022-10-12Update CHANGES.md and NEWS.md for new releaseMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19379)
2022-10-12Fix various typos, repeated words, align some spelling to LDP.FdaSilvaYY
Partially revamped from #16712 - fall thru -> fall through - time stamp -> timestamp - host name -> hostname - ipv6 -> IPv6 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19059)
2022-10-07Change all references to OpenSSL 3.1 to OpenSSL 3.2 in the master branchRichard Levitte
3.1 has been decided to be a FIPS 140-3 release, springing from the branch openssl-3.0, and the master branch to continue with the development of OpenSSL 3.2. Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19350)
2022-06-21Update CHANGES.md and NEWS.md for new releaseMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Release: yes
2022-05-08tls: ban SSL3, TLS1, TLS1.1 and DTLS1.0 at security level one and abovePauli
This is in line with the NEWS entry (erroneously) announcing such for 3.0. Fixes #18194 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/18236)
2022-05-06Correct NEWS entry about required security level for old versions of TLS, ↵Pauli
DTLS and SSL The entry was incorrect because suites using RSA key exchange without SHA1 were permitted at security level 1. Partial fix for #18194 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/18234) (cherry picked from commit 3226a37a4875567f2bf49aa44a727bcb67bb7dcd)
2022-05-03Update CHANGES and NEWS for new releaseMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Release: yes
2022-03-15Update CHANGES/NEWS for new releaseMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2022-03-10Add TFO support to socket BIO and s_client/s_serverTodd Short
Supports Linux, MacOS and FreeBSD Disabled by default, enabled via `enabled-tfo` Some tests Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8692)
2021-12-14NEWS.md: Add missing empty lineTomas Mraz
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17274)
2021-12-14Update CHANGES and NEWS for new releaseMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2021-09-21NEWS and CHANGES are updated about switching to utf8Dmitry Belyavskiy
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16583)
2021-09-07Last minute NEWS and CHANGES entries for the 3.0 releaseTomas Mraz
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16533)
2021-09-07Mention the concept of providers in NEWS.md and CHANGES.mdRichard Levitte
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16528) (cherry picked from commit 4c4ab4d7efdf8c9b49c9838742a0fcd7321d88ff)
2021-09-07Added a NEWS entry about the enhanced 'openssl list'Richard Levitte
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16522) (cherry picked from commit f43c1241c28526588f59e56c7f56422e0d23f411)
2021-09-07Add missing OSSL_DECODER entry in NEWS.md and CHANGES.mdRichard Levitte
The text in CHANGES.md got fleshed out a bit more as well. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16522) (cherry picked from commit d1a786e99b162793a8f4a70fe12d2c4e6f5ee608)
2021-09-03Prepare for 3.1Richard Levitte
Because we now have an openssl-3.0 branch, master is moved to be the next potential minor version. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16484)
2021-08-25news/changes: fix formatting nitsPauli
The news/changes files are being nitted causing CI failure. This addresses the issues. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16413)
2021-08-24Updates CHANGES.md and NEWS.md for new 1.1.1 releaseMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2021-07-29Prepare for 3.0 beta 3Matt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2021-07-29Prepare for release of 3.0 beta 2openssl-3.0.0-beta2Matt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2021-06-17Prepare for 3.0 beta 2Matt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2021-06-17Prepare for release of 3.0 beta 1openssl-3.0.0-beta1Matt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2021-06-16new: update NEWS.md so it is correct.Pauli
- Removing the deprecation note for public key commands. - Fixing the note about ECX and SHAKE in the FIPS provider. - Noting which KDFs are included. - Noting which MACs are included. Fixes #15743 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15746)
2021-06-16new: update NEWS.md so it is correct.Pauli
- Removing the deprecation note for public key commands. - Fixing the note about ECX and SHAKE in the FIPS provider. - Noting which KDFs are included. - Noting which MACs are included. Fixes #15743 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15746)
2021-05-20Prepare for 3.0 beta 1Matt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2021-05-20Prepare for release of 3.0 alpha 17openssl-3.0.0-alpha17Matt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2021-05-20Add migration guide for 3.0Shane Lontis
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14710)
2021-05-17Add a CHANGES entry for fully pluggable groupsMatt Caswell
Fixes #12283 Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/15282)
2021-05-14HTTP client API: Generalize to arbitrary request and response contentsDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15053)
2021-05-11Add convenience functions and macros for asymmetric key generationDr. David von Oheimb
Add EVP_PKEY_gen(), EVP_PKEY_Q_gen(), EVP_RSA_gen(), and EVP_EC_gen(). Also export auxiliary function OSSL_EC_curve_nid2name() and improve deprecation info on RSA and EC key generation/management functions. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14695)
2021-05-06Prepare for 3.0 alpha 17Matt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org>
2021-05-06Prepare for release of 3.0 alpha 16openssl-3.0.0-alpha16Matt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org>
2021-04-22Prepare for 3.0 alpha 16Matt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org>
2021-04-22Prepare for release of 3.0 alpha 15openssl-3.0.0-alpha15Matt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org>
2021-04-12Update KTLS documentationMatt Caswell
KTLS support has been changed to be off by default, and configuration is via a single "option" rather two "modes". Documentation is updated accordingly. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14799)
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-26 18:35:24 +0000