Update CHANGES and NEWS for the new release

Reviewed-by: Richard Levitte <levitte@openssl.org>

diff --git a/CHANGES b/CHANGES
index f2bc2b321d562661eb374d7dd46fb76d5d6d09ca..5e6295c00fddb1d4d367305a609f3693ba3d8ab7 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -9,7 +9,18 @@
 
  Changes between 1.0.2n and 1.0.2o [xx XXX xxxx]
 
-  *)
+  *) Constructed ASN.1 types with a recursive definition could exceed the stack
+
+     Constructed ASN.1 types with a recursive definition (such as can be found
+     in PKCS7) could eventually exceed the stack given malicious input with
+     excessive recursion. This could result in a Denial Of Service attack. There
+     are no such structures used within SSL/TLS that come from untrusted sources
+     so this is considered safe.
+
+     This issue was reported to OpenSSL on 4th January 2018 by the OSS-fuzz
+     project.
+     (CVE-2018-0739)
+     [Matt Caswell]
 
  Changes between 1.0.2m and 1.0.2n [7 Dec 2017]
 

diff --git a/NEWS b/NEWS
index f688c5aa55a766457c307cf31c1c646fca028acc..3cf97937f81a737af794c51bdb0f6c8f82448f19 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -7,7 +7,8 @@
 
   Major changes between OpenSSL 1.0.2n and OpenSSL 1.0.2o [under development]
 
-      o
+      o Constructed ASN.1 types with a recursive definition could exceed the
+        stack (CVE-2018-0739)
 
   Major changes between OpenSSL 1.0.2m and OpenSSL 1.0.2n [7 Dec 2017]