ECDH downgrade bug fix.

[openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index c444b24a2c1e612eced338aeeed589ee5fe8938d..0252eb570671c68678128e4c231c651b4b16d093 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -659,6 +659,13 @@
 
  Changes between 1.0.1j and 1.0.1k [xx XXX xxxx]
 
+  *) Abort handshake if server key exchange message is omitted for ephemeral
+     ECDH ciphersuites.
+
+     Thanks to Karthikeyan Bhargavan for reporting this issue.
+     (CVE-2014-3572)
+     [Steve Henson]
+
   *) Ensure that the session ID context of an SSL is updated when its
      SSL_CTX is updated via SSL_set_SSL_CTX.