Tighten session ticket handling

[openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index fdc19f31f3ba29535b8a3d4321d66fda67445623..de1f0c9fb0a14cf65719b89f0ea0b65b4da05a9f 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -2,7 +2,16 @@
  OpenSSL CHANGES
  _______________
 
- Changes between 1.0.1i and 1.0.1j [xx XXX xxxx]
+ Changes between 1.0.1j and 1.0.1k [xx XXX xxxx]
+
+  *) Tighten client-side session ticket handling during renegotiation:
+     ensure that the client only accepts a session ticket if the server sends
+     the extension anew in the ServerHello. Previously, a TLS client would
+     reuse the old extension state and thus accept a session ticket if one was
+     announced in the initial ServerHello.
+     [Emilia Käsper]
+
+ Changes between 1.0.1i and 1.0.1j [15 Oct 2014]
 
   *) SRTP Memory Leak.