From 62e4506a7d4cec1c8e1ff687f6b220f6a62a57c7 Mon Sep 17 00:00:00 2001
From: "Dr. Stephen Henson" <steve@openssl.org>
Date: Thu, 24 Jan 2013 13:30:42 +0000
Subject: Don't try and verify signatures if key is NULL (CVE-2013-0166) Add
 additional check to catch this in ASN1_item_verify too.

---
 CHANGES | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'CHANGES')

diff --git a/CHANGES b/CHANGES
index ef8b2bf76d..4cc7c134bd 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,6 +4,10 @@
 
  Changes between 1.0.1c and 1.0.1d [xx XXX xxxx]
 
+  *) Return an error when checking OCSP signatures when key is NULL.
+     This fixes a DoS attack. (CVE-2013-0166)
+     [Steve Henson]
+
   *) Make openssl verify return errors.
      [Chris Palmer <palmer@google.com> and Ben Laurie]
 
-- 
cgit v1.2.3