From 245daa2b733d66233450bab6880cd0afcddb61de Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Thu, 2 Jul 2015 15:38:32 +0100 Subject: [PATCH] Update CHANGES and NEWS for the new release Reviewed-by: Stephen Henson --- CHANGES | 13 ++++++++++++- NEWS | 2 +- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/CHANGES b/CHANGES index af27f3fdf5..7d4d2debfd 100644 --- a/CHANGES +++ b/CHANGES @@ -4,7 +4,18 @@ Changes between 1.0.1o and 1.0.1p [xx XXX xxxx] - *) + *) Alternate chains certificate forgery + + During certificate verfification, OpenSSL will attempt to find an + alternative certificate chain if the first attempt to build such a chain + fails. An error in the implementation of this logic can mean that an + attacker could cause certain checks on untrusted certificates to be + bypassed, such as the CA flag, enabling them to use a valid leaf + certificate to act as a CA and "issue" an invalid certificate. + + This issue was reported to OpenSSL by Adam Langley/David Benjamin + (Google/BoringSSL). + [Matt Caswell] Changes between 1.0.1n and 1.0.1o [12 Jun 2015] diff --git a/NEWS b/NEWS index 1d81d4ccf3..c736b24730 100644 --- a/NEWS +++ b/NEWS @@ -7,7 +7,7 @@ Major changes between OpenSSL 1.0.1o and OpenSSL 1.0.1p [under development] - o + o Alternate chains certificate forgery (CVE-2015-1793) Major changes between OpenSSL 1.0.1n and OpenSSL 1.0.1o [12 Jun 2015] -- 2.25.1