From: Bodo Möller <bodo@openssl.org>
Date: Tue, 12 Sep 2006 14:42:09 +0000 (+0000)
Subject: Update
X-Git-Tag: OpenSSL_0_9_8d~9
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=8fdb296cbdf0228b4c08aa5621ca394db5a9ce45;p=openssl

Update
---

diff --git a/CHANGES b/CHANGES
index eaa579011e..01642e13e0 100644
--- a/CHANGES
+++ b/CHANGES
@@ -6,7 +6,8 @@
 
   *) Since 0.9.8b, ciphersuite strings naming explicit ciphersuites
      match only those.  Before that, "AES256-SHA" would be interpreted
-     as a pattern and match "AES128-SHA" too since we currently only
+     as a pattern and match "AES128-SHA" too (since AES128-SHA got
+     the same strength classification in 0.9.7h) as we currently only
      have a single AES bit in the ciphersuite description bitmap.
      That change, however, also applied to ciphersuite strings such as
      "RC4-MD5" that intentionally matched multiple ciphersuites --
@@ -991,7 +992,18 @@
      differing sizes.
      [Richard Levitte]
 
- Changes between 0.9.7j and 0.9.7k  [xx XXX xxxx]
+ Changes between 0.9.7k and 0.9.7l  [xx XXX xxxx]
+
+  *) Change ciphersuite string processing so that an explicit
+     ciphersuite selects this one ciphersuite (so that "AES256-SHA"
+     will no longer include "AES128-SHA"), and any other similar
+     ciphersuite (same bitmap) from *other* protocol versions (so that
+     "RC4-MD5" will still include both the SSL 2.0 ciphersuite and the
+     SSL 3.0/TLS 1.0 ciphersuite).  This is a backport combining
+     changes from 0.9.8b and 0.9.8d.
+     [Bodo Moeller]
+
+ Changes between 0.9.7j and 0.9.7k  [05 Sep 2006]
 
   *) Avoid PKCS #1 v1.5 signature attack discovered by Daniel Bleichenbacher
      (CVE-2006-4339)  [Ben Laurie and Google Security Team]