generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Update CHANGES and NEWS

Browse Source
This commit is contained in:
Dr. Stephen Henson 2014-06-05 09:00:01 +01:00
parent 8250e1b232
commit b9c9cd3ded
2 changed files with 36 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
CHANGES
View File

@ -4,6 +4,37 @@
Changes between 1.0.0l and 1.0.0m [xx XXX xxxx] Changes between 1.0.0l and 1.0.0m [xx XXX xxxx]
*) Fix for SSL/TLS MITM flaw. An attacker using a carefully crafted
handshake can force the use of weak keying material in OpenSSL
SSL/TLS clients and servers.
Thanks to KIKUCHI Masashi (Lepidum Co. Ltd.) for discovering and
researching this issue. (CVE-2014-0224)
[KIKUCHI Masashi, Steve Henson]
*) Fix DTLS recursion flaw. By sending an invalid DTLS handshake to an
OpenSSL DTLS client the code can be made to recurse eventually crashing
in a DoS attack.
Thanks to Imre Rad (Search-Lab Ltd.) for discovering this issue.
(CVE-2014-0221)
[Imre Rad, Steve Henson]
*) Fix DTLS invalid fragment vulnerability. A buffer overrun attack can
be triggered by sending invalid DTLS fragments to an OpenSSL DTLS
client or server. This is potentially exploitable to run arbitrary
code on a vulnerable client or server.
Thanks to Jüri Aedla for reporting this issue. (CVE-2014-0195)
[Jüri Aedla, Steve Henson]
*) Fix bug in TLS code where clients enable anonymous ECDH ciphersuites
are subject to a denial of service attack.
Thanks to Felix Gröbert and Ivan Fratric at Google for discovering
this issue. (CVE-2014-3470)
[Felix Gröbert, Ivan Fratric, Steve Henson]
*) Harmonize version and its documentation. -f flag is used to display *) Harmonize version and its documentation. -f flag is used to display
compilation flags. compilation flags.
[mancha <mancha1@zoho.com>] [mancha <mancha1@zoho.com>]

5
NEWS
View File

@ -7,7 +7,12 @@
Major changes between OpenSSL 1.0.0l and OpenSSL 1.0.0m [under development] Major changes between OpenSSL 1.0.0l and OpenSSL 1.0.0m [under development]
o Fix for CVE-2014-0224
o Fix for CVE-2014-0221
o Fix for CVE-2014-0195
o Fix for CVE-2014-3470
o Fix for CVE-2014-0076 o Fix for CVE-2014-0076
o Fix for CVE-2010-5298
Major changes between OpenSSL 1.0.0k and OpenSSL 1.0.0l [6 Jan 2014] Major changes between OpenSSL 1.0.0k and OpenSSL 1.0.0l [6 Jan 2014]