Prepare for 1.0.1g-dev

[openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index cfaebba26ab67f8962aea1cc4517efb82d104e99..f6fabf9380f42df03d1928877c8134a5084721cf 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -2,7 +2,21 @@
  OpenSSL CHANGES
  _______________
 
  OpenSSL CHANGES
  _______________
 

- Changes between 1.0.1e and 1.0.1f [xx XXX xxxx]
+ Changes between 1.0.1f and 1.0.1g [xx XXX xxxx]
+
+  *)
+
+ Changes between 1.0.1e and 1.0.1f [6 Jan 2014]
+
+  *) Fix for TLS record tampering bug. A carefully crafted invalid 
+     handshake could crash OpenSSL with a NULL pointer exception.
+     Thanks to Anton Johansson for reporting this issues.
+     (CVE-2013-4353)
+
+  *) Keep original DTLS digest and encryption contexts in retransmission
+     structures so we can use the previous session parameters if they need
+     to be resent. (CVE-2013-6450)
+     [Steve Henson]

 
   *) Add option SSL_OP_SAFARI_ECDHE_ECDSA_BUG (part of SSL_OP_ALL) which
      avoids preferring ECDHE-ECDSA ciphers when the client appears to be
 
   *) Add option SSL_OP_SAFARI_ECDHE_ECDSA_BUG (part of SSL_OP_ALL) which
      avoids preferring ECDHE-ECDSA ciphers when the client appears to be