From 4d2efa29f6ef9253402ab359d3bee256c3f403fc Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Wed, 15 Oct 2014 10:52:00 +0100 Subject: [PATCH] Updates to CHANGES file MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Reviewed-by: Bodo Möller --- CHANGES | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/CHANGES b/CHANGES index 8e9952dfab..b76e009bd6 100644 --- a/CHANGES +++ b/CHANGES @@ -4,6 +4,25 @@ Changes between 0.9.8zb and 0.9.8zc [xx XXX xxxx] + *) Session Ticket Memory Leak. + + When an OpenSSL SSL/TLS/DTLS server receives a session ticket the + integrity of that ticket is first verified. In the event of a session + ticket integrity check failing, OpenSSL will fail to free memory + causing a memory leak. By sending a large number of invalid session + tickets an attacker could exploit this issue in a Denial Of Service + attack. + (CVE-2014-3567) + [Steve Henson] + + *) Build option no-ssl3 is incomplete. + + When OpenSSL is configured with "no-ssl3" as a build option, servers + could accept and complete a SSL 3.0 handshake, and clients could be + configured to send them. + (CVE-2014-3568) + [Akamai and the OpenSSL team] + *) Add support for TLS_FALLBACK_SCSV. Client applications doing fallback retries should call SSL_set_mode(s, SSL_MODE_SEND_FALLBACK_SCSV). -- 2.25.1