From 8a5d624d5b76c0c3cfdcf4f7fa35c22af7ccbbaa Mon Sep 17 00:00:00 2001 From: "Dr. Stephen Henson" Date: Mon, 4 Feb 2013 22:57:49 +0000 Subject: [PATCH] Update CHANGES and NEWS --- CHANGES | 13 +++++++++++++ NEWS | 1 + 2 files changed, 14 insertions(+) diff --git a/CHANGES b/CHANGES index 6f6a922038..f21f58e3cf 100644 --- a/CHANGES +++ b/CHANGES @@ -4,6 +4,19 @@ Changes between 1.0.0j and 1.0.0k [xx XXX xxxx] + *) Make the decoding of SSLv3, TLS and DTLS CBC records constant time. + + This addresses the flaw in CBC record processing discovered by + Nadhem Alfardan and Kenny Paterson. Details of this attack can be found + at: http://www.isg.rhul.ac.uk/tls/ + + Thanks go to Nadhem Alfardan and Kenny Paterson of the Information + Security Group at Royal Holloway, University of London + (www.isg.rhul.ac.uk) for discovering this flaw and Adam Langley and + Emilia Käsper for the initial patch. + (CVE-2013-0169) + [Emilia Käsper, Adam Langley, Ben Laurie, Andy Polyakov, Steve Henson] + *) Return an error when checking OCSP signatures when key is NULL. This fixes a DoS attack. (CVE-2013-0166) [Steve Henson] diff --git a/NEWS b/NEWS index c943f96680..eb98f0e703 100644 --- a/NEWS +++ b/NEWS @@ -7,6 +7,7 @@ Major changes between OpenSSL 1.0.0j and OpenSSL 1.0.0k: + o Fix for SSL/TLS/DTLS CBC plaintext recovery attack CVE-2013-0169 o Fix OCSP bad key DoS attack CVE-2013-0166 Major changes between OpenSSL 1.0.0i and OpenSSL 1.0.0j: -- 2.50.1