fix comments

[openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index 9f15d3d6a1a74023b792a7a34320c6763a33dbeb..00ea5eecb2fd28d0a6ac734983bf3cf8c52ef86e 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -44,6 +44,10 @@
 
  Changes between 0.9.8m (?) and 1.0.0  [xx XXX xxxx]
 
+  *) Add new -subject_hash_old and -issuer_hash_old options to x509 utility to
+     output hashes compatible with older versions of OpenSSL.
+     [Willy Weisz <weisz@vcpc.univie.ac.at>]
+
   *) Fix compression algorithm handling: if resuming a session use the
      compression algorithm of the resumed session instead of determining
      it from client hello again. Don't allow server to change algorithm.
@@ -877,6 +881,20 @@
 
  Changes between 0.9.8l (?) and 0.9.8m (?)  [xx XXX xxxx]
 
+  *) Handle TLS versions 2.0 and later properly and correctly use the
+     highest version of TLS/SSL supported. Although TLS >= 2.0 is some way
+     off ancient servers have a habit of sticking around for a while...
+     [Steve Henson]
+
+  *) Modify compression code so it frees up structures without using the
+     ex_data callbacks. This works around a problem where some applications
+     call CRYPTO_free_all_ex_data() before application exit (e.g. when
+     restarting) then use compression (e.g. SSL with compression) later.
+     This results in significant per-connection memory leaks and
+     has caused some security issues including CVE-2008-1678 and
+     CVE-2009-4355.
+     [Steve Henson]
+
   *) Add option SSL_OP_LEGACY_SERVER_CONNECT which will allow clients to
      connect (but not renegotiate) with servers which do not support RI.
      Until RI is more widely deployed this option is enabled by default.
@@ -905,7 +923,7 @@
      the updated NID creation version. This should correctly handle UTF8.
      [Steve Henson]
 
-  *) Implement draft-ietf-tls-renegotiation. Re-enable
+  *) Implement draft-ietf-tls-renegotiation-03. Re-enable
      renegotiation but require the extension as needed. Unfortunately,
      SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION turns out to be a
      bad idea. It has been replaced by