projects / oweals / openssl.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 1632ef7) | patch
Fix for CVE-2014-0224
authorDr. Stephen Henson <steve@openssl.org>
Fri, 16 May 2014 11:49:48 +0000 (12:49 +0100)
committerDr. Stephen Henson <steve@openssl.org>
Thu, 5 Jun 2014 08:04:27 +0000 (09:04 +0100)
commitbc8923b1ec9c467755cd86f7848c50ee8812e441
treec9873db8cc4f63ab3e6af6680d54f21a6074fb14tree | snapshot
parent1632ef744872edc2aa2a53d487d3e79c965a4ad3commit | diff
Fix for CVE-2014-0224

Only accept change cipher spec when it is expected instead of at any
time. This prevents premature setting of session keys before the master
secret is determined which an attacker could use as a MITM attack.

Thanks to KIKUCHI Masashi (Lepidum Co. Ltd.) for reporting this issue
and providing the initial fix this patch is based on.
ssl/s3_clnt.c diff | blob | history
ssl/s3_pkt.c diff | blob | history
ssl/s3_srvr.c diff | blob | history
ssl/ssl3.h diff | blob | history
Unnamed repository; edit this file 'description' to name the repository.