Don't try and verify signatures if key is NULL (CVE-2013-0166)

[openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index 559a8f67367ea152c99c5412ee5afca239c03a90..8adac3b6d415b380497c39c7ccdbfbbda06d183f 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -4,7 +4,19 @@
 
  Changes between 0.9.8x and 0.9.8y [xx XXX xxxx]
 
-  *)
+  *) Return an error when checking OCSP signatures when key is NULL.
+     This fixes a DoS attack. (CVE-2013-0166)
+     [Steve Henson]
+
+  *) Call OCSP Stapling callback after ciphersuite has been chosen, so
+     the right response is stapled. Also change SSL_get_certificate()
+     so it returns the certificate actually sent.
+     See http://rt.openssl.org/Ticket/Display.html?id=2836.
+     (This is a backport)
+     [Rob Stradling <rob.stradling@comodo.com>]
+
+  *) Fix possible deadlock when decoding public keys.
+     [Steve Henson]
 
  Changes between 0.9.8w and 0.9.8x [10 May 2012]