projects / openssl.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 9d2c9dd) | patch
Fix for CVE-2014-0224
authorDr. Stephen Henson <steve@openssl.org>
Fri, 16 May 2014 11:49:48 +0000 (12:49 +0100)
committerDr. Stephen Henson <steve@openssl.org>
Thu, 5 Jun 2014 12:24:46 +0000 (13:24 +0100)
commit77719aefb8f549ccc7f04222174889615d62057b
tree9a9d993acb8c565a8a730e2cee79072c0bdb5a13tree | snapshot
parent9d2c9dd1e1a452939a733b638d180bb308ce72a9commit | diff
Fix for CVE-2014-0224

Only accept change cipher spec when it is expected instead of at any
time. This prevents premature setting of session keys before the master
secret is determined which an attacker could use as a MITM attack.

Thanks to KIKUCHI Masashi (Lepidum Co. Ltd.) for reporting this issue
and providing the initial fix this patch is based on.
(cherry picked from commit bc8923b1ec9c467755cd86f7848c50ee8812e441)
ssl/s3_clnt.c diff | blob | history
ssl/s3_pkt.c diff | blob | history
ssl/s3_srvr.c diff | blob | history
ssl/ssl3.h diff | blob | history
Unnamed repository; edit this file 'description' to name the repository.