CHANGES

 OpenSSL CHANGES
 _______________

 This is a high-level summary of the most important changes.
 For a full list of changes, see the git commit log; for example,
 https://github.com/openssl/openssl/commits/ and pick the appropriate
 release branch.

 Changes between 1.1.0f and 1.1.1 [xx XXX xxxx]

  *) In the UI interface, make it possible to duplicate the user data.  This
     can be used by engines that need to retain the data for a longer time
     than just the call where this user data is passed.
     [Richard Levitte]

  *) Fragmented SSL/TLS alerts are no longer accepted. An alert message is 2
     bytes long. In theory it is permissible in SSLv3 - TLSv1.2 to fragment such
     alerts across multiple records (some of which could be empty). In practice
     it make no sense to send an empty alert record, or to fragment one. TLSv1.3
     prohibts this altogether and other libraries (BoringSSL, NSS) do not
     support this at all. Supporting it adds significant complexity to the
     record layer, and its removal is unlikely to cause inter-operability
     issues.
     [Matt Caswell]

  *) Add the ASN.1 types INT32, UINT32, INT64, UINT64 and variants prefixed
     with Z.  These are meant to replace LONG and ZLONG and to be size safe.
     The use of LONG and ZLONG is discouraged and scheduled for deprecation
     in OpenSSL 1.2.0.
     [Richard Levitte]

  *) Add the 'z' and 'j' modifiers to BIO_printf() et al formatting string,
     'z' is to be used for [s]size_t, and 'j' - with [u]int64_t.
     [Richard Levitte, Andy Polyakov]

  *) Add EC_KEY_get0_engine(), which does for EC_KEY what RSA_get0_engine()
     does for RSA, etc.
     [Richard Levitte]

  *) Have 'config' recognise 64-bit mingw and choose 'mingw64' as the target
     platform rather than 'mingw'.
     [Richard Levitte]

  *) The functions X509_STORE_add_cert and X509_STORE_add_crl return
     success if they are asked to add an object which already exists
     in the store. This change cascades to other functions which load
     certificates and CRLs.
     [Paul Dale]

  *) x86_64 assembly pack: annotate code with DWARF CFI directives to
     facilitate stack unwinding even from assembly subroutines.
     [Andy Polyakov]

  *) Remove VAX C specific definitions of OPENSSL_EXPORT, OPENSSL_EXTERN.
     Also remove OPENSSL_GLOBAL entirely, as it became a no-op.
     [Richard Levitte]

  *) Remove the VMS-specific reimplementation of gmtime from crypto/o_times.c.
     VMS C's RTL has a fully up to date gmtime() and gmtime_r() since V7.1,
     which is the minimum version we support.
     [Richard Levitte]

  *) Certificate time validation (X509_cmp_time) enforces stricter
     compliance with RFC 5280. Fractional seconds and timezone offsets
     are no longer allowed.
     [Emilia Käsper]

  *) Add support for ARIA
     [Paul Dale]

  *) s_client will now send the Server Name Indication (SNI) extension by
     default unless the new "-noservername" option is used. The server name is
     based on the host provided to the "-connect" option unless overridden by
     using "-servername".
     [Matt Caswell]

  *) Add support for SipHash
     [Todd Short]

  *) OpenSSL now fails if it receives an unrecognised record type in TLS1.0
     or TLS1.1. Previously this only happened in SSLv3 and TLS1.2. This is to
     prevent issues where no progress is being made and the peer continually
     sends unrecognised record types, using up resources processing them.
     [Matt Caswell]

  *) 'openssl passwd' can now produce SHA256 and SHA512 based output,
     using the algorithm defined in
     https://www.akkadia.org/drepper/SHA-crypt.txt
     [Richard Levitte]

  *) Heartbeat support has been removed; the ABI is changed for now.
     [Richard Levitte, Rich Salz]

  *) Support for SSL_OP_NO_ENCRYPT_THEN_MAC in SSL_CONF_cmd.
     [Emilia Käsper]

  *) The RSA "null" method, which was partially supported to avoid patent
     issues, has been replaced to always returns NULL.
     [Rich Salz]

 Changes between 1.1.0e and 1.1.0f [25 May 2017]

  *) Have 'config' recognise 64-bit mingw and choose 'mingw64' as the target
     platform rather than 'mingw'.
     [Richard Levitte]

  *) Remove the VMS-specific reimplementation of gmtime from crypto/o_times.c.
     VMS C's RTL has a fully up to date gmtime() and gmtime_r() since V7.1,
     which is the minimum version we support.
     [Richard Levitte]

 Changes between 1.1.0d and 1.1.0e [16 Feb 2017]

  *) Encrypt-Then-Mac renegotiation crash

     During a renegotiation handshake if the Encrypt-Then-Mac extension is
     negotiated where it was not in the original handshake (or vice-versa) then
     this can cause OpenSSL to crash (dependant on ciphersuite). Both clients
     and servers are affected.

     This issue was reported to OpenSSL by Joe Orton (Red Hat).
     (CVE-2017-3733)
     [Matt Caswell]

 Changes between 1.1.0c and 1.1.0d [26 Jan 2017]

  *) Truncated packet could crash via OOB read

     If one side of an SSL/TLS path is running on a 32-bit host and a specific
     cipher is being used, then a truncated packet can cause that host to
     perform an out-of-bounds read, usually resulting in a crash.

     This issue was reported to OpenSSL by Robert Święcki of Google.
     (CVE-2017-3731)
     [Andy Polyakov]

  *) Bad (EC)DHE parameters cause a client crash

     If a malicious server supplies bad parameters for a DHE or ECDHE key
     exchange then this can result in the client attempting to dereference a
     NULL pointer leading to a client crash. This could be exploited in a Denial
     of Service attack.

     This issue was reported to OpenSSL by Guido Vranken.
     (CVE-2017-3730)
     [Matt Caswell]

  *) BN_mod_exp may produce incorrect results on x86_64

     There is a carry propagating bug in the x86_64 Montgomery squaring
     procedure. No EC algorithms are affected. Analysis suggests that attacks
     against RSA and DSA as a result of this defect would be very difficult to
     perform and are not believed likely. Attacks against DH are considered just
     feasible (although very difficult) because most of the work necessary to
     deduce information about a private key may be performed offline. The amount
     of resources required for such an attack would be very significant and
     likely only accessible to a limited number of attackers. An attacker would
     additionally need online access to an unpatched system using the target
     private key in a scenario with persistent DH parameters and a private
     key that is shared between multiple clients. For example this can occur by
     default in OpenSSL DHE based SSL/TLS ciphersuites. Note: This issue is very
     similar to CVE-2015-3193 but must be treated as a separate problem.

     This issue was reported to OpenSSL by the OSS-Fuzz project.
     (CVE-2017-3732)
     [Andy Polyakov]

 Changes between 1.1.0b and 1.1.0c [10 Nov 2016]

  *) ChaCha20/Poly1305 heap-buffer-overflow

     TLS connections using *-CHACHA20-POLY1305 ciphersuites are susceptible to
     a DoS attack by corrupting larger payloads. This can result in an OpenSSL
     crash. This issue is not considered to be exploitable beyond a DoS.

     This issue was reported to OpenSSL by Robert Święcki (Google Security Team)
     (CVE-2016-7054)
     [Richard Levitte]

  *) CMS Null dereference

     Applications parsing invalid CMS structures can crash with a NULL pointer
     dereference. This is caused by a bug in the handling of the ASN.1 CHOICE
     type in OpenSSL 1.1.0 which can result in a NULL value being passed to the
     structure callback if an attempt is made to free certain invalid encodings.
     Only CHOICE structures using a callback which do not handle NULL value are
     affected.

     This issue was reported to OpenSSL by Tyler Nighswander of ForAllSecure.
     (CVE-2016-7053)
     [Stephen Henson]

  *) Montgomery multiplication may produce incorrect results

     There is a carry propagating bug in the Broadwell-specific Montgomery
     multiplication procedure that handles input lengths divisible by, but
     longer than 256 bits. Analysis suggests that attacks against RSA, DSA
     and DH private keys are impossible. This is because the subroutine in
     question is not used in operations with the private key itself and an input