diff options
author | jkim <jkim@FreeBSD.org> | 2014-06-09 05:50:57 +0000 |
---|---|---|
committer | jkim <jkim@FreeBSD.org> | 2014-06-09 05:50:57 +0000 |
commit | 68fed3306b1f39bfb6d5cd97485248dc0c3884f8 (patch) | |
tree | 3b5358dd257bf44bb4ea15442ad4bdb078b6795f /crypto/openssl/CHANGES | |
parent | e15884d6df140228c1e2db4ca751565a6933e1f5 (diff) | |
parent | d4a5f67323e640990da5aa727b2e6da35d2157f3 (diff) | |
download | FreeBSD-src-68fed3306b1f39bfb6d5cd97485248dc0c3884f8.zip FreeBSD-src-68fed3306b1f39bfb6d5cd97485248dc0c3884f8.tar.gz |
Merge OpenSSL 1.0.1h.
Approved by: so (delphij)
Diffstat (limited to 'crypto/openssl/CHANGES')
-rw-r--r-- | crypto/openssl/CHANGES | 44 |
1 files changed, 44 insertions, 0 deletions
diff --git a/crypto/openssl/CHANGES b/crypto/openssl/CHANGES index 4fcfd1d..d161eca 100644 --- a/crypto/openssl/CHANGES +++ b/crypto/openssl/CHANGES @@ -2,6 +2,50 @@ OpenSSL CHANGES _______________ + Changes between 1.0.1g and 1.0.1h [5 Jun 2014] + + *) Fix for SSL/TLS MITM flaw. An attacker using a carefully crafted + handshake can force the use of weak keying material in OpenSSL + SSL/TLS clients and servers. + + Thanks to KIKUCHI Masashi (Lepidum Co. Ltd.) for discovering and + researching this issue. (CVE-2014-0224) + [KIKUCHI Masashi, Steve Henson] + + *) Fix DTLS recursion flaw. By sending an invalid DTLS handshake to an + OpenSSL DTLS client the code can be made to recurse eventually crashing + in a DoS attack. + + Thanks to Imre Rad (Search-Lab Ltd.) for discovering this issue. + (CVE-2014-0221) + [Imre Rad, Steve Henson] + + *) Fix DTLS invalid fragment vulnerability. A buffer overrun attack can + be triggered by sending invalid DTLS fragments to an OpenSSL DTLS + client or server. This is potentially exploitable to run arbitrary + code on a vulnerable client or server. + + Thanks to Jüri Aedla for reporting this issue. (CVE-2014-0195) + [Jüri Aedla, Steve Henson] + + *) Fix bug in TLS code where clients enable anonymous ECDH ciphersuites + are subject to a denial of service attack. + + Thanks to Felix Gröbert and Ivan Fratric at Google for discovering + this issue. (CVE-2014-3470) + [Felix Gröbert, Ivan Fratric, Steve Henson] + + *) Harmonize version and its documentation. -f flag is used to display + compilation flags. + [mancha <mancha1@zoho.com>] + + *) Fix eckey_priv_encode so it immediately returns an error upon a failure + in i2d_ECPrivateKey. + [mancha <mancha1@zoho.com>] + + *) Fix some double frees. These are not thought to be exploitable. + [mancha <mancha1@zoho.com>] + Changes between 1.0.1f and 1.0.1g [7 Apr 2014] *) A missing bounds check in the handling of the TLS heartbeat extension |