Loading CHANGES +28 −2 Original line number Original line Diff line number Diff line Loading @@ -2,7 +2,10 @@ OpenSSL CHANGES OpenSSL CHANGES _______________ _______________ Changes between 1.0.0c and 1.0.0d [xx XXX xxxx] Changes between 1.0.0c and 1.0.0d [8 Feb 2011] *) Fix parsing of OCSP stapling ClientHello extension. CVE-2011-0014 [Neel Mehta, Adam Langley, Bodo Moeller (Google)] *) Fix bug in string printing code: if *any* escaping is enabled we must *) Fix bug in string printing code: if *any* escaping is enabled we must escape the escape character (backslash) or the resulting string is escape the escape character (backslash) or the resulting string is Loading Loading @@ -879,11 +882,34 @@ *) Change 'Configure' script to enable Camellia by default. *) Change 'Configure' script to enable Camellia by default. [NTT] [NTT] Changes between 0.9.8o and 0.9.8p [xx XXX xxxx] Changes between 0.9.8q and 0.9.8r [8 Feb 2011] *) Fix parsing of OCSP stapling ClientHello extension. CVE-2011-0014 [Neel Mehta, Adam Langley, Bodo Moeller (Google)] *) Fix bug in string printing code: if *any* escaping is enabled we must escape the escape character (backslash) or the resulting string is ambiguous. [Steve Henson] Changes between 0.9.8p and 0.9.8q [2 Dec 2010] *) Disable code workaround for ancient and obsolete Netscape browsers and servers: an attacker can use it in a ciphersuite downgrade attack. Thanks to Martin Rex for discovering this bug. CVE-2010-4180 [Steve Henson] *) Fixed J-PAKE implementation error, originally discovered by Sebastien Martini, further info and confirmation from Stefan Arentz and Feng Hao. Note that this fix is a security fix. CVE-2010-4252 [Ben Laurie] Changes between 0.9.8o and 0.9.8p [16 Nov 2010] *) Fix extension code to avoid race conditions which can result in a buffer *) Fix extension code to avoid race conditions which can result in a buffer overrun vulnerability: resumed sessions must not be modified as they can overrun vulnerability: resumed sessions must not be modified as they can be shared by multiple threads. CVE-2010-3864 be shared by multiple threads. CVE-2010-3864 [Steve Henson] *) Fix for double free bug in ssl/s3_clnt.c CVE-2010-2939 *) Fix for double free bug in ssl/s3_clnt.c CVE-2010-2939 [Steve Henson] [Steve Henson] Loading FAQ +1 −1 Original line number Original line Diff line number Diff line Loading @@ -82,7 +82,7 @@ OpenSSL - Frequently Asked Questions * Which is the current version of OpenSSL? * Which is the current version of OpenSSL? The current version is available from <URL: http://www.openssl.org>. The current version is available from <URL: http://www.openssl.org>. OpenSSL 1.0.0c was released on Dec 2nd, 2010. OpenSSL 1.0.0d was released on Feb 8th, 2011. In addition to the current stable release, you can also access daily In addition to the current stable release, you can also access daily snapshots of the OpenSSL development version at <URL: snapshots of the OpenSSL development version at <URL: Loading LICENSE +1 −1 Original line number Original line Diff line number Diff line Loading @@ -12,7 +12,7 @@ --------------- --------------- /* ==================================================================== /* ==================================================================== * Copyright (c) 1998-2008 The OpenSSL Project. All rights reserved. * Copyright (c) 1998-2011 The OpenSSL Project. All rights reserved. * * * Redistribution and use in source and binary forms, with or without * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * modification, are permitted provided that the following conditions Loading NEWS +8 −0 Original line number Original line Diff line number Diff line Loading @@ -5,6 +5,10 @@ This file gives a brief overview of the major changes between each OpenSSL This file gives a brief overview of the major changes between each OpenSSL release. For more details please read the CHANGES file. release. For more details please read the CHANGES file. Major changes between OpenSSL 1.0.0c and OpenSSL 1.0.0d: o Fix for security issue CVE-2011-0014 Major changes between OpenSSL 1.0.0b and OpenSSL 1.0.0c: Major changes between OpenSSL 1.0.0b and OpenSSL 1.0.0c: o Fix for security issue CVE-2010-4180 o Fix for security issue CVE-2010-4180 Loading Loading @@ -47,6 +51,10 @@ o Opaque PRF Input TLS extension support. o Opaque PRF Input TLS extension support. o Updated time routines to avoid OS limitations. o Updated time routines to avoid OS limitations. Major changes between OpenSSL 0.9.8q and OpenSSL 0.9.8r: o Fix for security issue CVE-2011-0014 Major changes between OpenSSL 0.9.8p and OpenSSL 0.9.8q: Major changes between OpenSSL 0.9.8p and OpenSSL 0.9.8q: o Fix for security issue CVE-2010-4180 o Fix for security issue CVE-2010-4180 Loading README +2 −2 Original line number Original line Diff line number Diff line OpenSSL 1.0.0d-dev OpenSSL 1.0.0d Copyright (c) 1998-2010 The OpenSSL Project Copyright (c) 1998-2011 The OpenSSL Project Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson All rights reserved. All rights reserved. Loading Loading
CHANGES +28 −2 Original line number Original line Diff line number Diff line Loading @@ -2,7 +2,10 @@ OpenSSL CHANGES OpenSSL CHANGES _______________ _______________ Changes between 1.0.0c and 1.0.0d [xx XXX xxxx] Changes between 1.0.0c and 1.0.0d [8 Feb 2011] *) Fix parsing of OCSP stapling ClientHello extension. CVE-2011-0014 [Neel Mehta, Adam Langley, Bodo Moeller (Google)] *) Fix bug in string printing code: if *any* escaping is enabled we must *) Fix bug in string printing code: if *any* escaping is enabled we must escape the escape character (backslash) or the resulting string is escape the escape character (backslash) or the resulting string is Loading Loading @@ -879,11 +882,34 @@ *) Change 'Configure' script to enable Camellia by default. *) Change 'Configure' script to enable Camellia by default. [NTT] [NTT] Changes between 0.9.8o and 0.9.8p [xx XXX xxxx] Changes between 0.9.8q and 0.9.8r [8 Feb 2011] *) Fix parsing of OCSP stapling ClientHello extension. CVE-2011-0014 [Neel Mehta, Adam Langley, Bodo Moeller (Google)] *) Fix bug in string printing code: if *any* escaping is enabled we must escape the escape character (backslash) or the resulting string is ambiguous. [Steve Henson] Changes between 0.9.8p and 0.9.8q [2 Dec 2010] *) Disable code workaround for ancient and obsolete Netscape browsers and servers: an attacker can use it in a ciphersuite downgrade attack. Thanks to Martin Rex for discovering this bug. CVE-2010-4180 [Steve Henson] *) Fixed J-PAKE implementation error, originally discovered by Sebastien Martini, further info and confirmation from Stefan Arentz and Feng Hao. Note that this fix is a security fix. CVE-2010-4252 [Ben Laurie] Changes between 0.9.8o and 0.9.8p [16 Nov 2010] *) Fix extension code to avoid race conditions which can result in a buffer *) Fix extension code to avoid race conditions which can result in a buffer overrun vulnerability: resumed sessions must not be modified as they can overrun vulnerability: resumed sessions must not be modified as they can be shared by multiple threads. CVE-2010-3864 be shared by multiple threads. CVE-2010-3864 [Steve Henson] *) Fix for double free bug in ssl/s3_clnt.c CVE-2010-2939 *) Fix for double free bug in ssl/s3_clnt.c CVE-2010-2939 [Steve Henson] [Steve Henson] Loading
FAQ +1 −1 Original line number Original line Diff line number Diff line Loading @@ -82,7 +82,7 @@ OpenSSL - Frequently Asked Questions * Which is the current version of OpenSSL? * Which is the current version of OpenSSL? The current version is available from <URL: http://www.openssl.org>. The current version is available from <URL: http://www.openssl.org>. OpenSSL 1.0.0c was released on Dec 2nd, 2010. OpenSSL 1.0.0d was released on Feb 8th, 2011. In addition to the current stable release, you can also access daily In addition to the current stable release, you can also access daily snapshots of the OpenSSL development version at <URL: snapshots of the OpenSSL development version at <URL: Loading
LICENSE +1 −1 Original line number Original line Diff line number Diff line Loading @@ -12,7 +12,7 @@ --------------- --------------- /* ==================================================================== /* ==================================================================== * Copyright (c) 1998-2008 The OpenSSL Project. All rights reserved. * Copyright (c) 1998-2011 The OpenSSL Project. All rights reserved. * * * Redistribution and use in source and binary forms, with or without * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * modification, are permitted provided that the following conditions Loading
NEWS +8 −0 Original line number Original line Diff line number Diff line Loading @@ -5,6 +5,10 @@ This file gives a brief overview of the major changes between each OpenSSL This file gives a brief overview of the major changes between each OpenSSL release. For more details please read the CHANGES file. release. For more details please read the CHANGES file. Major changes between OpenSSL 1.0.0c and OpenSSL 1.0.0d: o Fix for security issue CVE-2011-0014 Major changes between OpenSSL 1.0.0b and OpenSSL 1.0.0c: Major changes between OpenSSL 1.0.0b and OpenSSL 1.0.0c: o Fix for security issue CVE-2010-4180 o Fix for security issue CVE-2010-4180 Loading Loading @@ -47,6 +51,10 @@ o Opaque PRF Input TLS extension support. o Opaque PRF Input TLS extension support. o Updated time routines to avoid OS limitations. o Updated time routines to avoid OS limitations. Major changes between OpenSSL 0.9.8q and OpenSSL 0.9.8r: o Fix for security issue CVE-2011-0014 Major changes between OpenSSL 0.9.8p and OpenSSL 0.9.8q: Major changes between OpenSSL 0.9.8p and OpenSSL 0.9.8q: o Fix for security issue CVE-2010-4180 o Fix for security issue CVE-2010-4180 Loading
README +2 −2 Original line number Original line Diff line number Diff line OpenSSL 1.0.0d-dev OpenSSL 1.0.0d Copyright (c) 1998-2010 The OpenSSL Project Copyright (c) 1998-2011 The OpenSSL Project Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson All rights reserved. All rights reserved. Loading
