From 548cce63dd401b89e26d049152e3f9465f82720f Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Tue, 20 Nov 2018 10:52:53 +0000 Subject: Update CHANGES and NEWS for new release Reviewed-by: Richard Levitte Reviewed-by: Nicola Tuveri (Merged from https://github.com/openssl/openssl/pull/7667) --- CHANGES | 10 ++++++++++ NEWS | 3 ++- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/CHANGES b/CHANGES index fde66b5ba4..11d72327c5 100644 --- a/CHANGES +++ b/CHANGES @@ -22,6 +22,16 @@ (CVE-2018-5407) [Billy Brumley] + *) Timing vulnerability in DSA signature generation + + The OpenSSL DSA signature algorithm has been shown to be vulnerable to a + timing side channel attack. An attacker could use variations in the signing + algorithm to recover the private key. + + This issue was reported to OpenSSL on 16th October 2018 by Samuel Weiser. + (CVE-2018-0734) + [Paul Dale] + *) Resolve a compatibility issue in EC_GROUP handling with the FIPS Object Module, accidentally introduced while backporting security fixes from the development branch and hindering the use of ECC in FIPS mode. diff --git a/NEWS b/NEWS index 2c5f5f8330..38fe668ffa 100644 --- a/NEWS +++ b/NEWS @@ -7,7 +7,8 @@ Major changes between OpenSSL 1.0.2p and OpenSSL 1.0.2q [under development] - o + o Microarchitecture timing vulnerability in ECC scalar multiplication (CVE-2018-5407) + o Timing vulnerability in DSA signature generation (CVE-2018-0734) Major changes between OpenSSL 1.0.2o and OpenSSL 1.0.2p [14 Aug 2018] -- cgit v1.2.3