X-Git-Url: https://git.openssl.org/gitweb/?p=openssl.git;a=blobdiff_plain;f=CHANGES;h=404ac85690e7fd8c1ee1841721b4d129516d6c6c;hp=1b10b774a955999cebfd03f0b720bc7147c14a31;hb=6cc0068430d0a4abdef0b466d422e6a4d154a5fe;hpb=f9b6c0ba4c02497782f801e3c45688f3efaac55c

diff --git a/CHANGES b/CHANGES
index 1b10b774a9..404ac85690 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2038,6 +2038,10 @@
      This fixes a DoS attack. (CVE-2013-0166)
      [Steve Henson]
 
+  *) Return an error when checking OCSP signatures when key is NULL.
+     This fixes a DoS attack. (CVE-2013-0166)
+     [Steve Henson]
+
   *) Call OCSP Stapling callback after ciphersuite has been chosen, so
      the right response is stapled. Also change SSL_get_certificate()
      so it returns the certificate actually sent.