start 0.9.8s-dev

[oweals/openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index 4f98cec905d2add354e4e533f1f0ef0349405028..43299af8ec862655a4cd61c51a07bf2697836455 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -2,10 +2,32 @@
  OpenSSL CHANGES
  _______________
 
- Changes between 0.9.8p and 0.9.8q [xx XXX xxxx]
+ Changes between 0.9.8r and 0.9.8s [xx XXX xxxx]
 
   *)
 
+ Changes between 0.9.8q and 0.9.8r [8 Feb 2011]
+
+  *) Fix parsing of OCSP stapling ClientHello extension. CVE-2011-0014
+     [Neel Mehta, Adam Langley, Bodo Moeller (Google)]
+
+  *) Fix bug in string printing code: if *any* escaping is enabled we must
+     escape the escape character (backslash) or the resulting string is
+     ambiguous.
+     [Steve Henson]
+
+ Changes between 0.9.8p and 0.9.8q [2 Dec 2010]
+
+  *) Disable code workaround for ancient and obsolete Netscape browsers
+     and servers: an attacker can use it in a ciphersuite downgrade attack.
+     Thanks to Martin Rex for discovering this bug. CVE-2010-4180
+     [Steve Henson]
+
+  *) Fixed J-PAKE implementation error, originally discovered by
+     Sebastien Martini, further info and confirmation from Stefan
+     Arentz and Feng Hao. Note that this fix is a security fix. CVE-2010-4252
+     [Ben Laurie]
+
  Changes between 0.9.8o and 0.9.8p [16 Nov 2010]
 
   *) Fix extension code to avoid race conditions which can result in a buffer