Go into the error state if a fatal alert is sent or received
1.1.0 is not impacted by CVE-2019-1559, but this commit is a follow on
from that. That CVE was a result of applications calling SSL_shutdown
after a fatal alert has occurred. By chance 1.1.0 is not vulnerable to
that issue, but this change is additional hardening to prevent other
similar issues.
Reviewed-by: Richard Levitte <levitte@openssl.org>
parent
ad01b01c
Please register or sign in to comment