Tighten session ticket handling

[openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index c20b87348920ba2ac62e2deb788f9637cb42202e..de1f0c9fb0a14cf65719b89f0ea0b65b4da05a9f 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -4,7 +4,12 @@
 
  Changes between 1.0.1j and 1.0.1k [xx XXX xxxx]
 
-  *)
+  *) Tighten client-side session ticket handling during renegotiation:
+     ensure that the client only accepts a session ticket if the server sends
+     the extension anew in the ServerHello. Previously, a TLS client would
+     reuse the old extension state and thus accept a session ticket if one was
+     announced in the initial ServerHello.
+     [Emilia Käsper]
 
  Changes between 1.0.1i and 1.0.1j [15 Oct 2014]