diff options
author | Jung-uk Kim <jkim@FreeBSD.org> | 2018-03-27 17:17:58 +0000 |
---|---|---|
committer | Jung-uk Kim <jkim@FreeBSD.org> | 2018-03-27 17:17:58 +0000 |
commit | dee36b4f92f269b95977ae9c4a37046fb7cc351c (patch) | |
tree | 4aeec7120da3b01809775b5aad4fed5259c752ab /crypto/openssl/CHANGES | |
parent | 0457d75c14e0daaa43bd0375f6ec77fb8403e57a (diff) | |
parent | 02be298e504b8554caca6dc85af450e1ea44d19d (diff) | |
download | src-test2-dee36b4f92f269b95977ae9c4a37046fb7cc351c.tar.gz src-test2-dee36b4f92f269b95977ae9c4a37046fb7cc351c.zip |
Notes
Diffstat (limited to 'crypto/openssl/CHANGES')
-rw-r--r-- | crypto/openssl/CHANGES | 22 |
1 files changed, 20 insertions, 2 deletions
diff --git a/crypto/openssl/CHANGES b/crypto/openssl/CHANGES index f2fc31a25c54..cc142508b9a4 100644 --- a/crypto/openssl/CHANGES +++ b/crypto/openssl/CHANGES @@ -7,6 +7,21 @@ https://github.com/openssl/openssl/commits/ and pick the appropriate release branch. + Changes between 1.0.2n and 1.0.2o [27 Mar 2018] + + *) Constructed ASN.1 types with a recursive definition could exceed the stack + + Constructed ASN.1 types with a recursive definition (such as can be found + in PKCS7) could eventually exceed the stack given malicious input with + excessive recursion. This could result in a Denial Of Service attack. There + are no such structures used within SSL/TLS that come from untrusted sources + so this is considered safe. + + This issue was reported to OpenSSL on 4th January 2018 by the OSS-fuzz + project. + (CVE-2018-0739) + [Matt Caswell] + Changes between 1.0.2m and 1.0.2n [7 Dec 2017] *) Read/write after SSL object in error state @@ -2012,8 +2027,11 @@ to work with OPENSSL_NO_SSL_INTERN defined. [Steve Henson] - *) Add SRP support. - [Tom Wu <tjw@cs.stanford.edu> and Ben Laurie] + *) A long standing patch to add support for SRP from EdelWeb (Peter + Sylvester and Christophe Renou) was integrated. + [Christophe Renou <christophe.renou@edelweb.fr>, Peter Sylvester + <peter.sylvester@edelweb.fr>, Tom Wu <tjw@cs.stanford.edu>, and + Ben Laurie] *) Add functions to copy EVP_PKEY_METHOD and retrieve flags and id. [Steve Henson] |