constify EVP_PKEY_new_mac_key()

[oweals/openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index ae47318517227310f93848a3708de9e465e0ffb6..b6d5e660d25d32e51c6ac2d2ddebf123605e6aae 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -40,6 +40,10 @@
 
  Changes between 1.0.0a and 1.0.0b  [xx XXX xxxx]
 
+  *) Fix extension code to avoid race conditions which can result in a buffer
+     overrun vulnerability: resumed sessions must not be modified as they can
+     be shared by multiple threads. CVE-2010-3864
+
   *) Fix WIN32 build system to correctly link an ENGINE directory into
      a DLL. 
      [Steve Henson]
@@ -893,6 +897,10 @@
   
  Changes between 0.9.8o and 0.9.8p [xx XXX xxxx]
 
+  *) Fix extension code to avoid race conditions which can result in a buffer
+     overrun vulnerability: resumed sessions must not be modified as they can
+     be shared by multiple threads. CVE-2010-3864
+
   *) Fix for double free bug in ssl/s3_clnt.c CVE-2010-2939
      [Steve Henson]