projects / oweals / openssl.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: ec2fede) | patch
ECDH downgrade bug fix.
authorDr. Stephen Henson <steve@openssl.org>
Fri, 24 Oct 2014 11:30:33 +0000 (12:30 +0100)
committerDr. Stephen Henson <steve@openssl.org>
Mon, 5 Jan 2015 23:59:04 +0000 (23:59 +0000)
commite42a2abadc90664e2615dc63ba7f79cf163f780a
tree9e98eb7d77dade5a272e791642e4db89fefefeadtree | snapshot
parentec2fede9467ae1a65f452d3a39f7fbc4891d9285commit | diff
ECDH downgrade bug fix.

Fix bug where an OpenSSL client would accept a handshake using an
ephemeral ECDH ciphersuites with the server key exchange message omitted.

Thanks to Karthikeyan Bhargavan for reporting this issue.

CVE-2014-3572
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit b15f8769644b00ef7283521593360b7b2135cb63)

Conflicts:
CHANGES
ssl/s3_clnt.c
CHANGES diff | blob | history
ssl/s3_clnt.c diff | blob | history
Unnamed repository; edit this file 'description' to name the repository.