diff options
author | Matt Caswell <matt@openssl.org> | 2015-07-02 15:38:32 +0100 |
---|---|---|
committer | Matt Caswell <matt@openssl.org> | 2015-07-09 09:30:46 +0100 |
commit | 6f47ced0157059edee2d4c0d94fcf76e08763c5f (patch) | |
tree | 137a18a76d953c9135d24f86bf2c4c0bfb80e039 /CHANGES | |
parent | 7f3f41d816bb80e362a5978420f59030b3132c81 (diff) | |
download | openssl-6f47ced0157059edee2d4c0d94fcf76e08763c5f.tar.gz |
Update CHANGES and NEWS for the new release
Reviewed-by: Stephen Henson <steve@openssl.org>
Diffstat (limited to 'CHANGES')
-rw-r--r-- | CHANGES | 24 |
1 files changed, 23 insertions, 1 deletions
@@ -434,7 +434,29 @@ whose return value is often ignored. [Steve Henson] - Changes between 1.0.2a and 1.0.2b [xx XXX xxxx] + Changes between 1.0.2c and 1.0.2d [xx XXX xxxx] + + *) Alternate chains certificate forgery + + During certificate verfification, OpenSSL will attempt to find an + alternative certificate chain if the first attempt to build such a chain + fails. An error in the implementation of this logic can mean that an + attacker could cause certain checks on untrusted certificates to be + bypassed, such as the CA flag, enabling them to use a valid leaf + certificate to act as a CA and "issue" an invalid certificate. + + This issue was reported to OpenSSL by Adam Langley/David Benjamin + (Google/BoringSSL). + [Matt Caswell] + + Changes between 1.0.2b and 1.0.2c [12 Jun 2015] + + *) Fix HMAC ABI incompatibility. The previous version introduced an ABI + incompatibility in the handling of HMAC. The previous ABI has now been + restored. + [Matt Caswell] + + Changes between 1.0.2a and 1.0.2b [11 Jun 2015] *) Malformed ECParameters causes infinite loop |