From 23424be835dc10f0942c91952142d75345ef9de1 Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Tue, 21 Apr 2020 10:33:43 +0100 Subject: [PATCH] Update CHANGES and NEWS for release of 1.1.1g Reviewed-by: Richard Levitte --- CHANGES | 10 ++++++++++ NEWS | 2 +- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/CHANGES b/CHANGES index 6239fa4139..d655eb0654 100644 --- a/CHANGES +++ b/CHANGES @@ -9,6 +9,16 @@ Changes between 1.1.1f and 1.1.1g [xx XXX xxxx] + *) Fixed segmentation fault in SSL_check_chain() + Server or client applications that call the SSL_check_chain() function + during or after a TLS 1.3 handshake may crash due to a NULL pointer + dereference as a result of incorrect handling of the + "signature_algorithms_cert" TLS extension. The crash occurs if an invalid + or unrecognised signature algorithm is received from the peer. This could + be exploited by a malicious peer in a Denial of Service attack. + (CVE-2020-1967) + [Benjamin Kaduk] + *) Added AES consttime code for no-asm configurations an optional constant time support for AES was added when building openssl for no-asm. diff --git a/NEWS b/NEWS index 79202c3af2..55eed4d874 100644 --- a/NEWS +++ b/NEWS @@ -7,7 +7,7 @@ Major changes between OpenSSL 1.1.1f and OpenSSL 1.1.1g [under development] - o + o Fixed segmentation fault in SSL_check_chain() (CVE-2020-1967) Major changes between OpenSSL 1.1.1e and OpenSSL 1.1.1f [31 Mar 2020] -- 2.25.1