X-Git-Url: https://git.openssl.org/gitweb/?a=blobdiff_plain;f=CHANGES;h=8adac3b6d415b380497c39c7ccdbfbbda06d183f;hb=99f5093347c65eecbd05f0668aea94b32fcf20d7;hp=d2b75771a5d25dec658deaa84ec9a123e0de2d97;hpb=6dde222aaed732533282a42cd60854796d42d79b;p=openssl.git

diff --git a/CHANGES b/CHANGES
index d2b75771a5..8adac3b6d4 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2,6 +2,36 @@
  OpenSSL CHANGES
  _______________
 
+ Changes between 0.9.8x and 0.9.8y [xx XXX xxxx]
+
+  *) Return an error when checking OCSP signatures when key is NULL.
+     This fixes a DoS attack. (CVE-2013-0166)
+     [Steve Henson]
+
+  *) Call OCSP Stapling callback after ciphersuite has been chosen, so
+     the right response is stapled. Also change SSL_get_certificate()
+     so it returns the certificate actually sent.
+     See http://rt.openssl.org/Ticket/Display.html?id=2836.
+     (This is a backport)
+     [Rob Stradling <rob.stradling@comodo.com>]
+
+  *) Fix possible deadlock when decoding public keys.
+     [Steve Henson]
+
+ Changes between 0.9.8w and 0.9.8x [10 May 2012]
+
+  *) Sanity check record length before skipping explicit IV in DTLS
+     to fix DoS attack.
+
+     Thanks to Codenomicon for discovering this issue using Fuzz-o-Matic
+     fuzzing as a service testing platform.
+     (CVE-2012-2333)
+     [Steve Henson]
+
+  *) Initialise tkeylen properly when encrypting CMS messages.
+     Thanks to Solar Designer of Openwall for reporting this issue.
+     [Steve Henson]
+
  Changes between 0.9.8v and 0.9.8w [23 Apr 2012]
 
   *) The fix for CVE-2012-2110 did not take into account that the