oweals/openssl.git
12 years agofix leak
Dr. Stephen Henson [Thu, 22 Mar 2012 16:28:51 +0000 (16:28 +0000)]
fix leak

12 years agoSubmitted by: Markus Friedl <mfriedl@gmail.com>
Dr. Stephen Henson [Thu, 22 Mar 2012 15:43:19 +0000 (15:43 +0000)]
Submitted by: Markus Friedl <mfriedl@gmail.com>

Fix memory leaks in 'goto err' cases.

12 years agoupdate version to 1.0.1a-dev
Dr. Stephen Henson [Thu, 22 Mar 2012 15:18:19 +0000 (15:18 +0000)]
update version to 1.0.1a-dev

12 years agouse client version when deciding whether to send supported signature algorithms extension
Dr. Stephen Henson [Wed, 21 Mar 2012 21:32:57 +0000 (21:32 +0000)]
use client version when deciding whether to send supported signature algorithms extension

12 years agoAlways use SSLv23_{client,server}_method in s_client.c and s_server.c,
Dr. Stephen Henson [Sun, 18 Mar 2012 18:16:05 +0000 (18:16 +0000)]
Always use SSLv23_{client,server}_method in s_client.c and s_server.c,
the old code came from SSLeay days before TLS was even supported.

12 years agobsaes-x86_64.pl: optimize key conversion [from HEAD].
Andy Polyakov [Fri, 16 Mar 2012 21:45:51 +0000 (21:45 +0000)]
bsaes-x86_64.pl: optimize key conversion [from HEAD].

12 years agoremove trailing slash
Dr. Stephen Henson [Wed, 14 Mar 2012 22:20:40 +0000 (22:20 +0000)]
remove trailing slash

12 years agocipher should only be set to PSK if JPAKE is used. OpenSSL_1_0_1
Richard Levitte [Wed, 14 Mar 2012 12:39:00 +0000 (12:39 +0000)]
cipher should only be set to PSK if JPAKE is used.

12 years agoupdate STATUS
Dr. Stephen Henson [Wed, 14 Mar 2012 12:14:06 +0000 (12:14 +0000)]
update STATUS

12 years agoprepare for 1.0.1 release
Dr. Stephen Henson [Wed, 14 Mar 2012 12:04:40 +0000 (12:04 +0000)]
prepare for 1.0.1 release

12 years agoupdate NEWS
Dr. Stephen Henson [Tue, 13 Mar 2012 22:49:27 +0000 (22:49 +0000)]
update NEWS

12 years agossl/t1_enc.c: pay attention to EVP_CIPH_FLAG_CUSTOM_CIPHER [from HEAD].
Andy Polyakov [Tue, 13 Mar 2012 19:21:15 +0000 (19:21 +0000)]
ssl/t1_enc.c: pay attention to EVP_CIPH_FLAG_CUSTOM_CIPHER [from HEAD].

12 years agox86_64-xlate.pl: remove old kludge.
Andy Polyakov [Tue, 13 Mar 2012 19:19:31 +0000 (19:19 +0000)]
x86_64-xlate.pl: remove old kludge.
PR: 2435,2440

12 years agocorrected fix to PR#2711 and also cover mime_param_cmp
Dr. Stephen Henson [Mon, 12 Mar 2012 16:29:47 +0000 (16:29 +0000)]
corrected fix to PR#2711 and also cover mime_param_cmp

12 years agoFix for CMS/PKCS7 MMA. If RSA decryption fails use a random key and
Dr. Stephen Henson [Mon, 12 Mar 2012 16:27:50 +0000 (16:27 +0000)]
Fix for CMS/PKCS7 MMA. If RSA decryption fails use a random key and
continue with symmetric decryption process to avoid leaking timing
information to an attacker.

Thanks to Ivan Nestlerode <inestlerode@us.ibm.com> for discovering
this issue. (CVE-2012-0884)

12 years agoPR: 2744
Dr. Stephen Henson [Sun, 11 Mar 2012 13:40:05 +0000 (13:40 +0000)]
PR: 2744
Submitted by: Dmitry Belyavsky <beldmit@gmail.com>

CMS support for ccgost engine

12 years agoSubmitted by: Peter Sylvester <peter.sylvester@edelweb.fr>
Dr. Stephen Henson [Fri, 9 Mar 2012 18:37:41 +0000 (18:37 +0000)]
Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr>

Add more extension names in s_cb.c extension printing code.

12 years agoPR: 2756
Dr. Stephen Henson [Fri, 9 Mar 2012 15:52:20 +0000 (15:52 +0000)]
PR: 2756
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>

Fix DTLS timeout handling.

12 years agocheck return value of BIO_write in PKCS7_decrypt
Dr. Stephen Henson [Thu, 8 Mar 2012 14:02:51 +0000 (14:02 +0000)]
check return value of BIO_write in PKCS7_decrypt

12 years agoPR: 2755
Dr. Stephen Henson [Tue, 6 Mar 2012 13:47:27 +0000 (13:47 +0000)]
PR: 2755
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>

Reduce MTU after failed transmissions.

12 years agoPR: 2748
Dr. Stephen Henson [Tue, 6 Mar 2012 13:24:16 +0000 (13:24 +0000)]
PR: 2748
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>

Fix possible DTLS timer deadlock.

12 years agoConfigure: make no-whirlpool work [from HEAD].
Andy Polyakov [Sat, 3 Mar 2012 13:18:06 +0000 (13:18 +0000)]
Configure: make no-whirlpool work [from HEAD].

12 years agoOn OpenVMS, try sha256 and sha512 et al as well.
Richard Levitte [Thu, 1 Mar 2012 21:29:58 +0000 (21:29 +0000)]
On OpenVMS, try sha256 and sha512 et al as well.

12 years agoFor OpenVMS, use inttypes.h instead of stdint.h
Richard Levitte [Thu, 1 Mar 2012 21:29:16 +0000 (21:29 +0000)]
For OpenVMS, use inttypes.h instead of stdint.h

12 years agoPR: 2743
Dr. Stephen Henson [Wed, 29 Feb 2012 14:12:52 +0000 (14:12 +0000)]
PR: 2743
Reported by: Dmitry Belyavsky <beldmit@gmail.com>

Fix memory leak if invalid GOST MAC key given.

12 years agoPR: 2742
Dr. Stephen Henson [Wed, 29 Feb 2012 14:01:53 +0000 (14:01 +0000)]
PR: 2742
Reported by: Dmitry Belyavsky <beldmit@gmail.com>

If resigning with detached content in CMS just copy data across.

12 years agoFix memory leak cause by race condition when creating public keys.
Dr. Stephen Henson [Tue, 28 Feb 2012 14:47:16 +0000 (14:47 +0000)]
Fix memory leak cause by race condition when creating public keys.

Thanks to Ivan Nestlerode <inestlerode@us.ibm.com> for reporting this bug.

12 years agox86cpuid.pl: fix processor capability detection on pre-586 [from HEAD].
Andy Polyakov [Tue, 28 Feb 2012 14:20:34 +0000 (14:20 +0000)]
x86cpuid.pl: fix processor capability detection on pre-586 [from HEAD].

12 years agoPR: 2736
Dr. Stephen Henson [Mon, 27 Feb 2012 18:45:18 +0000 (18:45 +0000)]
PR: 2736
Reported by: Remi Gacogne <rgacogne-bugs@coredump.fr>

Preserve unused bits value in non-canonicalised ASN1_STRING structures
by using ASN1_STRING_copy which preseves flags.

12 years agoPR: 2737
Dr. Stephen Henson [Mon, 27 Feb 2012 16:46:45 +0000 (16:46 +0000)]
PR: 2737
Submitted by: Remi Gacogne <rgacogne-bugs@coredump.fr>

Fix double free in PKCS12_parse if we run out of memory.

12 years agoPR: 2739
Dr. Stephen Henson [Mon, 27 Feb 2012 16:38:10 +0000 (16:38 +0000)]
PR: 2739
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>

Fix padding bugs in Heartbeat support.

12 years agoPR: 2735
Dr. Stephen Henson [Mon, 27 Feb 2012 16:33:25 +0000 (16:33 +0000)]
PR: 2735

Make cryptodev digests work. Thanks to Nikos Mavrogiannopoulos for
this fix.

12 years agofree headers after use in error message
Dr. Stephen Henson [Mon, 27 Feb 2012 16:27:09 +0000 (16:27 +0000)]
free headers after use in error message

12 years agoDetect symmetric crypto errors in PKCS7_decrypt.
Dr. Stephen Henson [Mon, 27 Feb 2012 15:22:54 +0000 (15:22 +0000)]
Detect symmetric crypto errors in PKCS7_decrypt.

Thanks to Ivan Nestlerode <inestlerode@us.ibm.com> for reporting this bug.

12 years agoConfigure: remove adding of -D_XPG4_2 -D__EXTENSIONS__ in sctp builds,
Andy Polyakov [Sun, 26 Feb 2012 22:03:41 +0000 (22:03 +0000)]
Configure: remove adding of -D_XPG4_2 -D__EXTENSIONS__ in sctp builds,
see corresponding commit to HEAD for details.

12 years agoseed.c: Solaris portability fix from HEAD.
Andy Polyakov [Sun, 26 Feb 2012 21:53:28 +0000 (21:53 +0000)]
seed.c: Solaris portability fix from HEAD.

12 years agoPR: 2730
Dr. Stephen Henson [Sat, 25 Feb 2012 17:58:03 +0000 (17:58 +0000)]
PR: 2730
Submitted by: Arpadffy Zoltan <Zoltan.Arpadffy@scientificgames.se>

VMS fixes: disable SCTP by default.

12 years agocorrect CHANGES OpenSSL_1_0_1-beta3
Dr. Stephen Henson [Thu, 23 Feb 2012 22:13:59 +0000 (22:13 +0000)]
correct CHANGES

12 years agoPR: 2711
Dr. Stephen Henson [Thu, 23 Feb 2012 21:50:32 +0000 (21:50 +0000)]
PR: 2711
Submitted by: Tomas Mraz <tmraz@redhat.com>

Tolerate bad MIME headers in parser.

12 years agoPR: 2696
Dr. Stephen Henson [Thu, 23 Feb 2012 21:31:22 +0000 (21:31 +0000)]
PR: 2696
Submitted by: Rob Austein <sra@hactrn.net>

Fix inverted range problem in RFC3779 code.

Thanks to Andrew Chi for generating test cases for this bug.

12 years agoPR: 2727
Dr. Stephen Henson [Thu, 23 Feb 2012 13:49:22 +0000 (13:49 +0000)]
PR: 2727
Submitted by: Bruce Stephens <bruce.stephens@isode.com>

Use same construct for EXHEADER in srp/Makefile as other makefiles to cope
with possibly empty EXHEADER.

12 years agoABI compliance fixes.
Dr. Stephen Henson [Wed, 22 Feb 2012 14:01:44 +0000 (14:01 +0000)]
ABI compliance fixes.

Move new structure fields to end of structures.

Import library codes from 1.0.0 and recreate new ones.

12 years agoupdate NEWS
Dr. Stephen Henson [Tue, 21 Feb 2012 14:21:32 +0000 (14:21 +0000)]
update NEWS

12 years agotypo
Dr. Stephen Henson [Fri, 17 Feb 2012 17:31:32 +0000 (17:31 +0000)]
typo

12 years agoFix bug in CVE-2011-4619: check we have really received a client hello
Dr. Stephen Henson [Thu, 16 Feb 2012 15:25:39 +0000 (15:25 +0000)]
Fix bug in CVE-2011-4619: check we have really received a client hello
before rejecting multiple SGC restarts.

12 years agoAdditional compatibility fix for MDC2 signature format.
Dr. Stephen Henson [Wed, 15 Feb 2012 14:14:01 +0000 (14:14 +0000)]
Additional compatibility fix for MDC2 signature format.

Update RSA EVP_PKEY_METHOD to use the OCTET STRING form of MDC2 signature:
this will make all versions of MDC2 signature equivalent.

12 years agoAn incompatibility has always existed between the format used for RSA
Dr. Stephen Henson [Wed, 15 Feb 2012 14:00:09 +0000 (14:00 +0000)]
An incompatibility has always existed between the format used for RSA
signatures and MDC2 using EVP or RSA_sign. This has become more apparent
when the dgst utility in OpenSSL 1.0.0 and later switched to using the
EVP_DigestSign functions which call RSA_sign.

This means that the signature format OpenSSL 1.0.0 and later used with
dgst -sign and MDC2 is incompatible with previous versions.

Add detection in RSA_verify so either format works.

Note: MDC2 is disabled by default in OpenSSL and very rarely used in practice.

12 years agoPR: 2708
Dr. Stephen Henson [Sun, 12 Feb 2012 23:20:21 +0000 (23:20 +0000)]
PR: 2708
Submitted by: Bruce Stephens <bruce.stephens@isode.com>

Translate path separators correctly for $fipsdir in util/mk1mf.pl

12 years agoPR: 2713
Dr. Stephen Henson [Sun, 12 Feb 2012 18:47:36 +0000 (18:47 +0000)]
PR: 2713
Submitted by: Tomas Mraz <tmraz@redhat.com>

Move libraries that are not needed for dynamic linking to Libs.private in
the .pc files

12 years agoPR: 2717
Dr. Stephen Henson [Sat, 11 Feb 2012 23:38:49 +0000 (23:38 +0000)]
PR: 2717
Submitted by: Tim Rice <tim@multitalents.net>

Make compilation work on OpenServer 5.0.7

12 years agoPR: 2716
Dr. Stephen Henson [Sat, 11 Feb 2012 23:21:09 +0000 (23:21 +0000)]
PR: 2716
Submitted by: Adam Langley <agl@google.com>

Fix handling of exporter return value and use OpenSSL indentation in
s_client, s_server.

12 years agoPR: 2703
Dr. Stephen Henson [Sat, 11 Feb 2012 23:12:59 +0000 (23:12 +0000)]
PR: 2703
Submitted by: Alexey Melnikov <alexey.melnikov@isode.com>

Fix some memory and resource leaks in CAPI ENGINE.

12 years agoPR: 2705
Dr. Stephen Henson [Sat, 11 Feb 2012 23:07:58 +0000 (23:07 +0000)]
PR: 2705
Submitted by: Alexey Melnikov <alexey.melnikov@isode.com>

Only create ex_data indices once for CAPI engine.

12 years agoSubmitted by: Eric Rescorla <ekr@rtfm.com>
Dr. Stephen Henson [Sat, 11 Feb 2012 22:53:48 +0000 (22:53 +0000)]
Submitted by: Eric Rescorla <ekr@rtfm.com>

Further fixes for use_srtp extension.

12 years agoapps/s_cb.c: recognize latest TLS versions [from HEAD].
Andy Polyakov [Sat, 11 Feb 2012 13:31:16 +0000 (13:31 +0000)]
apps/s_cb.c: recognize latest TLS versions [from HEAD].

12 years agoPR: 2704
Dr. Stephen Henson [Fri, 10 Feb 2012 20:08:49 +0000 (20:08 +0000)]
PR: 2704
Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr>

Fix srp extension.

12 years agoPR: 2710
Dr. Stephen Henson [Fri, 10 Feb 2012 19:54:46 +0000 (19:54 +0000)]
PR: 2710
Submitted by: Tomas Mraz <tmraz@redhat.com>

Check return codes for load_certs_crls.

12 years agoPR: 2714
Dr. Stephen Henson [Fri, 10 Feb 2012 19:44:00 +0000 (19:44 +0000)]
PR: 2714
Submitted by: Tomas Mraz <tmraz@redhat.com>

Make no-srp work.

12 years agoonly cleanup ctx if we need to, save ctx flags when we do
Dr. Stephen Henson [Fri, 10 Feb 2012 16:54:56 +0000 (16:54 +0000)]
only cleanup ctx if we need to, save ctx flags when we do

12 years agoadd fips hmac option and fips blocking overrides to command line utilities
Dr. Stephen Henson [Fri, 10 Feb 2012 16:46:19 +0000 (16:46 +0000)]
add fips hmac option and fips blocking overrides to command line utilities

12 years agoSubmitted by: Eric Rescorla <ekr@rtfm.com>
Dr. Stephen Henson [Fri, 10 Feb 2012 00:03:37 +0000 (00:03 +0000)]
Submitted by: Eric Rescorla <ekr@rtfm.com>

Fix encoding of use_srtp extension to be compliant with RFC5764

12 years agoModify client hello version when renegotiating to enhance interop with
Dr. Stephen Henson [Thu, 9 Feb 2012 15:41:44 +0000 (15:41 +0000)]
Modify client hello version when renegotiating to enhance interop with
some servers.

12 years agobn_nist.c: make new optimized code dependent on BN_LLONG [from HEAD].
Andy Polyakov [Thu, 2 Feb 2012 07:46:19 +0000 (07:46 +0000)]
bn_nist.c: make new optimized code dependent on BN_LLONG [from HEAD].

12 years agohpux-parisc2-*: engage assembler [from HEAD] and make it link.
Andy Polyakov [Thu, 2 Feb 2012 07:42:31 +0000 (07:42 +0000)]
hpux-parisc2-*: engage assembler [from HEAD] and make it link.

12 years agoghash-x86.pl: engage original MMX version in no-sse2 builds [from HEAD].
Andy Polyakov [Wed, 25 Jan 2012 17:56:25 +0000 (17:56 +0000)]
ghash-x86.pl: engage original MMX version in no-sse2 builds [from HEAD].

12 years agox86_64-xlate.pl: 1.0.1-specific typo.
Andy Polyakov [Wed, 25 Jan 2012 17:50:23 +0000 (17:50 +0000)]
x86_64-xlate.pl: 1.0.1-specific typo.

12 years agoonly include bn.h once
Dr. Stephen Henson [Tue, 24 Jan 2012 23:00:36 +0000 (23:00 +0000)]
only include bn.h once

12 years agoonly include evp.h once
Dr. Stephen Henson [Tue, 24 Jan 2012 22:59:46 +0000 (22:59 +0000)]
only include evp.h once

12 years agoonly include string.h once
Dr. Stephen Henson [Tue, 24 Jan 2012 22:58:46 +0000 (22:58 +0000)]
only include string.h once

12 years agoreturn error if md is NULL
Dr. Stephen Henson [Sun, 22 Jan 2012 13:12:50 +0000 (13:12 +0000)]
return error if md is NULL

12 years agocryptlib.c: make even non-Windows builds "strtoull-agnostic" [from HEAD].
Andy Polyakov [Sat, 21 Jan 2012 12:18:29 +0000 (12:18 +0000)]
cryptlib.c: make even non-Windows builds "strtoull-agnostic" [from HEAD].

12 years agox86_64-xlate.pl: proper solution for RT#2620 [from HEAD].
Andy Polyakov [Sat, 21 Jan 2012 11:35:20 +0000 (11:35 +0000)]
x86_64-xlate.pl: proper solution for RT#2620 [from HEAD].

12 years agochange version to beta3-dev
Dr. Stephen Henson [Thu, 19 Jan 2012 17:14:17 +0000 (17:14 +0000)]
change version to beta3-dev

12 years agoupdate files for beta2 release OpenSSL_1_0_1-beta2
Dr. Stephen Henson [Thu, 19 Jan 2012 15:46:43 +0000 (15:46 +0000)]
update files for beta2 release

12 years agoprepare for beta2
Dr. Stephen Henson [Thu, 19 Jan 2012 15:37:57 +0000 (15:37 +0000)]
prepare for beta2

12 years agoFix for DTLS DoS issue introduced by fix for CVE-2011-4109.
Dr. Stephen Henson [Wed, 18 Jan 2012 18:14:56 +0000 (18:14 +0000)]
Fix for DTLS DoS issue introduced by fix for CVE-2011-4109.
Thanks to Antonio Martin, Enterprise Secure Access Research and
Development, Cisco Systems, Inc. for discovering this bug and
preparing a fix. (CVE-2012-0050)

12 years agoundef some symbols that cause problems with make depend for fips builds
Dr. Stephen Henson [Wed, 18 Jan 2012 01:40:36 +0000 (01:40 +0000)]
undef some symbols that cause problems with make depend for fips builds

12 years agofix CHANGES entry
Dr. Stephen Henson [Tue, 17 Jan 2012 14:19:09 +0000 (14:19 +0000)]
fix CHANGES entry

12 years ago1.0.1-specific OPNESSL vs. OPENSSL typo.
Andy Polyakov [Sun, 15 Jan 2012 13:42:50 +0000 (13:42 +0000)]
1.0.1-specific OPNESSL vs. OPENSSL typo.
PR: 2613
Submitted by: Leena Heino

12 years agoFix OPNESSL vs. OPENSSL typos [from HEAD].
Andy Polyakov [Sun, 15 Jan 2012 13:40:21 +0000 (13:40 +0000)]
Fix OPNESSL vs. OPENSSL typos [from HEAD].
PR: 2613
Submitted by: Leena Heino

12 years agofix warning
Dr. Stephen Henson [Sun, 15 Jan 2012 13:30:52 +0000 (13:30 +0000)]
fix warning

12 years agoSanitize usage of <ctype.h> functions. It's important that characters
Andy Polyakov [Thu, 12 Jan 2012 16:28:03 +0000 (16:28 +0000)]
Sanitize usage of <ctype.h> functions. It's important that characters
are passed zero-extended, not sign-extended [from HEAD].
PR: 2682

12 years agosparcv9cap.c: omit unused variable.
Andy Polyakov [Thu, 12 Jan 2012 14:19:52 +0000 (14:19 +0000)]
sparcv9cap.c: omit unused variable.

12 years agodoc/apps: formatting fixes [from HEAD].
Andy Polyakov [Wed, 11 Jan 2012 21:58:42 +0000 (21:58 +0000)]
doc/apps: formatting fixes [from HEAD].
PR: 2683
Submitted by: Annie Yousar

12 years agospeed.c: typo in pkey_print_message [from HEAD].
Andy Polyakov [Wed, 11 Jan 2012 21:49:16 +0000 (21:49 +0000)]
speed.c: typo in pkey_print_message [from HEAD].
PR: 2681
Submitted by: Annie Yousar

12 years agoecdsa.pod: typo.
Andy Polyakov [Wed, 11 Jan 2012 21:41:50 +0000 (21:41 +0000)]
ecdsa.pod: typo.
PR: 2678
Submitted by: Annie Yousar

12 years agoasn1/t_x509.c: fix serial number print, harmonize with a_int.c [from HEAD].
Andy Polyakov [Wed, 11 Jan 2012 21:12:47 +0000 (21:12 +0000)]
asn1/t_x509.c: fix serial number print, harmonize with a_int.c [from HEAD].
PR: 2675
Submitted by: Annie Yousar

12 years agoaes-sparcv9.pl: clean up regexp [from HEAD].
Andy Polyakov [Wed, 11 Jan 2012 15:32:08 +0000 (15:32 +0000)]
aes-sparcv9.pl: clean up regexp [from HEAD].
PR: 2685

12 years agoPR: 2652
Dr. Stephen Henson [Thu, 5 Jan 2012 14:30:08 +0000 (14:30 +0000)]
PR: 2652
Submitted by: Arpadffy Zoltan <Zoltan.Arpadffy@scientificgames.se>

OpenVMS fixes.

12 years agoUpdate for 0.9.8s and 1.0.0f.
Bodo Möller [Thu, 5 Jan 2012 13:46:27 +0000 (13:46 +0000)]
Update for 0.9.8s and 1.0.0f.

(While the 1.0.0f CHANGES entry on VOS PRNG seeding was missing
in the 1.0.1 branch, the actual code is here already.)

12 years agoFix for builds without DTLS support.
Bodo Möller [Thu, 5 Jan 2012 10:22:39 +0000 (10:22 +0000)]
Fix for builds without DTLS support.

Submitted by: Brian Carlstrom

12 years agoPR: 2671
Dr. Stephen Henson [Thu, 5 Jan 2012 00:28:29 +0000 (00:28 +0000)]
PR: 2671
Submitted by: steve

Update maximum message size for certifiate verify messages to support
4096 bit RSA keys again as TLS v1.2 messages is two bytes longer.

12 years agoSubmitted by: Robin Seggelmann <seggelmann@fh-muenster.de>
Dr. Stephen Henson [Thu, 5 Jan 2012 00:23:31 +0000 (00:23 +0000)]
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>
Reviewed by: steve

Send fatal alert if heartbeat extension has an illegal value.

12 years agodisable heartbeats if tlsext disabled
Dr. Stephen Henson [Thu, 5 Jan 2012 00:07:34 +0000 (00:07 +0000)]
disable heartbeats if tlsext disabled

12 years agoupdate CHANGES
Dr. Stephen Henson [Wed, 4 Jan 2012 23:53:52 +0000 (23:53 +0000)]
update CHANGES

12 years agoSubmitted by: Robin Seggelmann <seggelmann@fh-muenster.de>, Michael Tuexen <tuexen...
Dr. Stephen Henson [Wed, 4 Jan 2012 23:52:05 +0000 (23:52 +0000)]
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>, Michael Tuexen <tuexen@fh-muenster.de>
Reviewed by: steve

Fix for DTLS plaintext recovery attack discovered by Nadhem Alfardan and
Kenny Paterson.

12 years agoClear bytes used for block padding of SSL 3.0 records. (CVE-2011-4576)
Dr. Stephen Henson [Wed, 4 Jan 2012 23:13:29 +0000 (23:13 +0000)]
Clear bytes used for block padding of SSL 3.0 records. (CVE-2011-4576)

12 years agofix CHANGES
Dr. Stephen Henson [Wed, 4 Jan 2012 23:11:43 +0000 (23:11 +0000)]
fix CHANGES

12 years agoOnly allow one SGC handshake restart for SSL/TLS. (CVE-2011-4619)
Dr. Stephen Henson [Wed, 4 Jan 2012 23:07:54 +0000 (23:07 +0000)]
Only allow one SGC handshake restart for SSL/TLS. (CVE-2011-4619)

12 years agoCheck GOST parameters are not NULL (CVE-2012-0027)
Dr. Stephen Henson [Wed, 4 Jan 2012 23:03:20 +0000 (23:03 +0000)]
Check GOST parameters are not NULL (CVE-2012-0027)