Disable SSLv2 cipher suites by default and avoid SSLv2 compatible client

[openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index e8f1748ac7222d7fa752f2358dbfcea48309a210..dff85b2b6e62020f8e4a9e56ccd3c9da34bf498d 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -4,6 +4,12 @@
 
  Changes between 0.9.8k and 1.0  [xx XXX xxxx]
 
+  *) If no SSLv2 ciphers are used don't use an SSLv2 compatible client hello:
+     this allows the use of compression and extensions. Change default cipher
+     string to remove SSLv2 ciphersuites. This effectively avoids ancient SSLv2
+     by default unless an application cipher string requests it.
+     [Steve Henson]
+
   *) Alter match criteria in PKCS12_parse(). It used to try to use local
      key ids to find matching certificates and keys but some PKCS#12 files
      don't follow the (somewhat unwritten) rules and this strategy fails.