Fix SRP buffer overrun vulnerability.

[openssl.git] / FAQ

diff --git a/FAQ b/FAQ
index b9243a610495fa4bcb5dda52f0c253f94fd45f00..f8ea604273a53f8354f17a768d806fa1a3541aed 100644 (file)
--- a/FAQ
+++ b/FAQ
@@ -10,6 +10,7 @@ OpenSSL  -  Frequently Asked Questions
 * Why aren't tools like 'autoconf' and 'libtool' used?
 * What is an 'engine' version?
 * How do I check the authenticity of the OpenSSL distribution?
 * Why aren't tools like 'autoconf' and 'libtool' used?
 * What is an 'engine' version?
 * How do I check the authenticity of the OpenSSL distribution?

+* How does the versioning scheme work?

 
 [LEGAL] Legal questions
 
 
 [LEGAL] Legal questions
 


@@ -82,11 +83,11 @@ OpenSSL  -  Frequently Asked Questions
 * Which is the current version of OpenSSL?
 
 The current version is available from <URL: http://www.openssl.org>.
 * Which is the current version of OpenSSL?
 
 The current version is available from <URL: http://www.openssl.org>.

-OpenSSL 1.0.1 was released on Mar 14th, 2012.
+OpenSSL 1.0.1e was released on Feb 11th, 2013.

 
 In addition to the current stable release, you can also access daily
 snapshots of the OpenSSL development version at <URL:
 
 In addition to the current stable release, you can also access daily
 snapshots of the OpenSSL development version at <URL:

-ftp://ftp.openssl.org/snapshot/>, or get it by anonymous CVS access.
+ftp://ftp.openssl.org/snapshot/>, or get it by anonymous Git access.

 
 
 * Where is the documentation?
 
 
 * Where is the documentation?


@@ -108,12 +109,9 @@ In addition, you can read the most current versions at
 <URL: http://www.openssl.org/docs/>. Note that the online documents refer
 to the very latest development versions of OpenSSL and may include features
 not present in released versions. If in doubt refer to the documentation
 <URL: http://www.openssl.org/docs/>. Note that the online documents refer
 to the very latest development versions of OpenSSL and may include features
 not present in released versions. If in doubt refer to the documentation

-that came with the version of OpenSSL you are using.
-
-For information on parts of libcrypto that are not yet documented, you
-might want to read Ariel Glenn's documentation on SSLeay 0.9, OpenSSL's
-predecessor, at <URL: http://www.columbia.edu/~ariel/ssleay/>.  Much
-of this still applies to OpenSSL.
+that came with the version of OpenSSL you are using. The pod format
+documentation is included in each OpenSSL distribution under the docs
+directory.

 
 There is some documentation about certificate extensions and PKCS#12
 in doc/openssl.txt
 
 There is some documentation about certificate extensions and PKCS#12
 in doc/openssl.txt


@@ -173,6 +171,19 @@ just do:
 
    pgp TARBALL.asc
 
 
    pgp TARBALL.asc
 

+* How does the versioning scheme work?
+
+After the release of OpenSSL 1.0.0 the versioning scheme changed. Letter 
+releases (e.g. 1.0.1a) can only contain bug and security fixes and no
+new features. Minor releases change the last number (e.g. 1.0.2) and 
+can contain new features that retain binary compatibility. Changes to
+the middle number are considered major releases and neither source nor
+binary compatibility is guaranteed.
+
+Therefore the answer to the common question "when will feature X be
+backported to OpenSSL 1.0.0/0.9.8?" is "never" but it could appear
+in the next minor release.
+

 [LEGAL] =======================================================================
 
 * Do I need patent licenses to use OpenSSL?
 [LEGAL] =======================================================================
 
 * Do I need patent licenses to use OpenSSL?


@@ -284,7 +295,7 @@ current directory in this case, but this has changed with 0.9.6a.)
 Check out the CA.pl(1) manual page. This provides a simple wrapper round
 the 'req', 'verify', 'ca' and 'pkcs12' utilities. For finer control check
 out the manual pages for the individual utilities and the certificate
 Check out the CA.pl(1) manual page. This provides a simple wrapper round
 the 'req', 'verify', 'ca' and 'pkcs12' utilities. For finer control check
 out the manual pages for the individual utilities and the certificate

-extensions documentation (currently in doc/openssl.txt).
+extensions documentation (in ca(1), req(1), x509v3_config(5) )

 
 
 * Why can't I create certificate requests?
 
 
 * Why can't I create certificate requests?


@@ -752,6 +763,9 @@ openssl-security@openssl.org if you don't get a prompt reply at least
 acknowledging receipt then resend or mail it directly to one of the
 more active team members (e.g. Steve).
 
 acknowledging receipt then resend or mail it directly to one of the
 more active team members (e.g. Steve).
 

+Note that bugs only present in the openssl utility are not in general
+considered to be security issues. 
+

 [PROG] ========================================================================
 
 * Is OpenSSL thread-safe?
 [PROG] ========================================================================
 
 * Is OpenSSL thread-safe?