From: Matt Caswell <matt@openssl.org>
Date: Thu, 16 Feb 2017 09:51:56 +0000 (+0000)
Subject: Update CHANGES and NEWS for new release
X-Git-Tag: OpenSSL_1_1_0e~1
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=aed24635b8c3a0635448c90ebee6eb2447be4a66;p=oweals%2Fopenssl.git

Update CHANGES and NEWS for new release

Reviewed-by: Richard Levitte <levitte@openssl.org>
---

diff --git a/CHANGES b/CHANGES
index d516e2cb25..88385c953b 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,7 +4,16 @@
 
  Changes between 1.1.0d and 1.1.0e [xx XXX xxxx]
 
-  *)
+  *) Encrypt-Then-Mac renegotiation crash
+
+     During a renegotiation handshake if the Encrypt-Then-Mac extension is
+     negotiated where it was not in the original handshake (or vice-versa) then
+     this can cause OpenSSL to crash (dependant on ciphersuite). Both clients
+     and servers are affected.
+
+     This issue was reported to OpenSSL by Joe Orton (Red Hat).
+     (CVE-2017-3733)
+     [Matt Caswell]
 
  Changes between 1.1.0c and 1.1.0d [26 Jan 2017]
 
diff --git a/NEWS b/NEWS
index 693bbecfc2..8e10c97705 100644
--- a/NEWS
+++ b/NEWS
@@ -7,7 +7,7 @@
 
   Major changes between OpenSSL 1.1.0d and OpenSSL 1.1.0e [under development]
 
-      o
+      o Encrypt-Then-Mac renegotiation crash (CVE-2017-3733)
 
   Major changes between OpenSSL 1.1.0c and OpenSSL 1.1.0d [26 Jan 2017]