Fix array bounds violation in ssl_session_dup

[openssl.git] / NEWS

diff --git a/NEWS b/NEWS
index f47482e8db80d79f9e1dec03a5155b86178a3b89..60c841f36f7008d8702be813a7104ed017011082 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -5,7 +5,7 @@
   This file gives a brief overview of the major changes between each OpenSSL
   release. For more details please read the CHANGES file.
 
-  Major changes between OpenSSL 1.1.0f and OpenSSL 1.1.1 [under development]
+  Major changes between OpenSSL 1.1.0h and OpenSSL 1.1.1 [in pre-release]
 
       o Support for TLSv1.3 added
       o Move the display of configuration data to configdata.pm.
@@ -24,6 +24,9 @@
 
   Major changes between OpenSSL 1.1.0g and OpenSSL 1.1.0h [under development]
 
+      o Constructed ASN.1 types with a recursive definition could exceed the
+        stack (CVE-2018-0739)
+      o Incorrect CRYPTO_memcmp on HP-UX PA-RISC (CVE-2018-0733)
       o rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738)
 
   Major changes between OpenSSL 1.1.0f and OpenSSL 1.1.0g [2 Nov 2017]