X-Git-Url: https://git.openssl.org/?p=openssl.git;a=blobdiff_plain;f=NEWS;h=ea0c71663ed2e3c6e0f22515bbbcb09bf3f5ccec;hp=909fea96cf7484691ded28286e2f84cdf7949077;hb=978c8aa8b79692d193437d28e2485ec5ffa9d6cc;hpb=0d8776344cd7965fadd870e361503985df9c45bb diff --git a/NEWS b/NEWS index 909fea96cf..ea0c71663e 100644 --- a/NEWS +++ b/NEWS @@ -5,8 +5,88 @@ This file gives a brief overview of the major changes between each OpenSSL release. For more details please read the CHANGES file. + Major changes between OpenSSL 1.0.1p and OpenSSL 1.0.1q [under development] + + o + + Major changes between OpenSSL 1.0.1o and OpenSSL 1.0.1p [9 Jul 2015] + + o Alternate chains certificate forgery (CVE-2015-1793) + + Major changes between OpenSSL 1.0.1n and OpenSSL 1.0.1o [12 Jun 2015] + + o Fix HMAC ABI incompatibility + + Major changes between OpenSSL 1.0.1m and OpenSSL 1.0.1n [11 Jun 2015] + + o Malformed ECParameters causes infinite loop (CVE-2015-1788) + o Exploitable out-of-bounds read in X509_cmp_time (CVE-2015-1789) + o PKCS7 crash with missing EnvelopedContent (CVE-2015-1790) + o CMS verify infinite loop with unknown hash function (CVE-2015-1792) + o Race condition handling NewSessionTicket (CVE-2015-1791) + + Major changes between OpenSSL 1.0.1l and OpenSSL 1.0.1m [19 Mar 2015] + + o Segmentation fault in ASN1_TYPE_cmp fix (CVE-2015-0286) + o ASN.1 structure reuse memory corruption fix (CVE-2015-0287) + o PKCS7 NULL pointer dereferences fix (CVE-2015-0289) + o DoS via reachable assert in SSLv2 servers fix (CVE-2015-0293) + o Use After Free following d2i_ECPrivatekey error fix (CVE-2015-0209) + o X509_to_X509_REQ NULL pointer deref fix (CVE-2015-0288) + o Removed the export ciphers from the DEFAULT ciphers + + Major changes between OpenSSL 1.0.1k and OpenSSL 1.0.1l [15 Jan 2015] + + o Build fixes for the Windows and OpenVMS platforms + + Major changes between OpenSSL 1.0.1j and OpenSSL 1.0.1k [8 Jan 2015] + + o Fix for CVE-2014-3571 + o Fix for CVE-2015-0206 + o Fix for CVE-2014-3569 + o Fix for CVE-2014-3572 + o Fix for CVE-2015-0204 + o Fix for CVE-2015-0205 + o Fix for CVE-2014-8275 + o Fix for CVE-2014-3570 + + Major changes between OpenSSL 1.0.1i and OpenSSL 1.0.1j [15 Oct 2014] + + o Fix for CVE-2014-3513 + o Fix for CVE-2014-3567 + o Mitigation for CVE-2014-3566 (SSL protocol vulnerability) + o Fix for CVE-2014-3568 + + Major changes between OpenSSL 1.0.1h and OpenSSL 1.0.1i [6 Aug 2014] + + o Fix for CVE-2014-3512 + o Fix for CVE-2014-3511 + o Fix for CVE-2014-3510 + o Fix for CVE-2014-3507 + o Fix for CVE-2014-3506 + o Fix for CVE-2014-3505 + o Fix for CVE-2014-3509 + o Fix for CVE-2014-5139 + o Fix for CVE-2014-3508 + + Major changes between OpenSSL 1.0.1g and OpenSSL 1.0.1h [5 Jun 2014] + + o Fix for CVE-2014-0224 + o Fix for CVE-2014-0221 + o Fix for CVE-2014-0198 + o Fix for CVE-2014-0195 + o Fix for CVE-2014-3470 + o Fix for CVE-2010-5298 + + Major changes between OpenSSL 1.0.1f and OpenSSL 1.0.1g [7 Apr 2014] + + o Fix for CVE-2014-0160 + o Add TLS padding extension workaround for broken servers. + o Fix for CVE-2014-0076 + Major changes between OpenSSL 1.0.1e and OpenSSL 1.0.1f [6 Jan 2014] + o Don't include gmt_unix_time in TLS server and client random values o Fix for TLS record tampering bug CVE-2013-4353 o Fix for TLS version checking bug CVE-2013-6449 o Fix for DTLS retransmission bug CVE-2013-6450 @@ -53,19 +133,6 @@ o Preliminary FIPS capability for unvalidated 2.0 FIPS module. o SRP support. - Major changes between OpenSSL 1.0.0j and OpenSSL 1.0.0k [5 Feb 2013]: - - o Fix for SSL/TLS/DTLS CBC plaintext recovery attack CVE-2013-0169 - o Fix OCSP bad key DoS attack CVE-2013-0166 - - Major changes between OpenSSL 1.0.0i and OpenSSL 1.0.0j [10 May 2012]: - - o Fix DTLS record length checking bug CVE-2012-2333 - - Major changes between OpenSSL 1.0.0h and OpenSSL 1.0.0i [19 Apr 2012]: - - o Fix for ASN1 overflow bug CVE-2012-2110 - Major changes between OpenSSL 1.0.0g and OpenSSL 1.0.0h [12 Mar 2012]: o Fix for CMS/PKCS#7 MMA CVE-2012-0884 @@ -138,62 +205,6 @@ o Opaque PRF Input TLS extension support. o Updated time routines to avoid OS limitations. - Major changes between OpenSSL 0.9.8x and OpenSSL 0.9.8y [5 Feb 2013]: - - o Fix for SSL/TLS/DTLS CBC plaintext recovery attack CVE-2013-0169 - o Fix OCSP bad key DoS attack CVE-2013-0166 - - Major changes between OpenSSL 0.9.8w and OpenSSL 0.9.8x [10 May 2012]: - - o Fix DTLS record length checking bug CVE-2012-2333 - - Major changes between OpenSSL 0.9.8v and OpenSSL 0.9.8w [23 Apr 2012]: - - o Fix for CVE-2012-2131 (corrected fix for 0.9.8 and CVE-2012-2110) - - Major changes between OpenSSL 0.9.8u and OpenSSL 0.9.8v [19 Apr 2012]: - - o Fix for ASN1 overflow bug CVE-2012-2110 - - Major changes between OpenSSL 0.9.8t and OpenSSL 0.9.8u [12 Mar 2012]: - - o Fix for CMS/PKCS#7 MMA CVE-2012-0884 - o Corrected fix for CVE-2011-4619 - o Various DTLS fixes. - - Major changes between OpenSSL 0.9.8s and OpenSSL 0.9.8t [18 Jan 2012]: - - o Fix for DTLS DoS issue CVE-2012-0050 - - Major changes between OpenSSL 0.9.8r and OpenSSL 0.9.8s [4 Jan 2012]: - - o Fix for DTLS plaintext recovery attack CVE-2011-4108 - o Fix policy check double free error CVE-2011-4109 - o Clear block padding bytes of SSL 3.0 records CVE-2011-4576 - o Only allow one SGC handshake restart for SSL/TLS CVE-2011-4619 - o Check for malformed RFC3779 data CVE-2011-4577 - - Major changes between OpenSSL 0.9.8q and OpenSSL 0.9.8r [8 Feb 2011]: - - o Fix for security issue CVE-2011-0014 - - Major changes between OpenSSL 0.9.8p and OpenSSL 0.9.8q [2 Dec 2010]: - - o Fix for security issue CVE-2010-4180 - o Fix for CVE-2010-4252 - - Major changes between OpenSSL 0.9.8o and OpenSSL 0.9.8p [16 Nov 2010]: - - o Fix for security issue CVE-2010-3864. - - Major changes between OpenSSL 0.9.8n and OpenSSL 0.9.8o [1 Jun 2010]: - - o Fix for security issue CVE-2010-0742. - o Various DTLS fixes. - o Recognise SHA2 certificates if only SSL algorithms added. - o Fix for no-rc4 compilation. - o Chil ENGINE unload workaround. - Major changes between OpenSSL 0.9.8m and OpenSSL 0.9.8n [24 Mar 2010]: o CFB cipher definition fixes.