Commit 72dce768 authored by Bodo Möller's avatar Bodo Möller
Browse files

Add fixes for CAN-2005-2969. 

(This were in 0.9.7-stable and 0.9.8-stable, but not in HEAD so far.)
parent ee8836c4

FAQ

+1 −1
Original line number Diff line number Diff line
@@ -73,7 +73,7 @@ OpenSSL - Frequently Asked Questions 
* Which is the current version of OpenSSL?



The current version is available from <URL: http://www.openssl.org>.

OpenSSL 0.9.8 was released on July 5th, 2005.

OpenSSL 0.9.8a was released on October 11th, 2005.



In addition to the current stable release, you can also access daily

snapshots of the OpenSSL development version at <URL:

NEWS

+5 −0
Original line number Diff line number Diff line
@@ -5,6 +5,11 @@ 
  This file gives a brief overview of the major changes between each OpenSSL

  release. For more details please read the CHANGES file.



  Major changes between OpenSSL 0.9.8 and OpenSSL 0.9.8a:



      o Fix potential SSL 2.0 rollback, CAN-2005-2969

      o Extended Windows CE support



  Major changes between OpenSSL 0.9.7g and OpenSSL 0.9.8:



      o Major work on the BIGNUM library for higher efficiency and to

STATUS

+4 −1
Original line number Diff line number Diff line 


  OpenSSL STATUS                           Last modified at

  ______________                           $Date: 2005/07/05 19:16:24 $

  ______________                           $Date: 2005/10/26 19:40:44 $



  DEVELOPMENT STATE



    o  OpenSSL 0.9.9:  Under development...

    o  OpenSSL 0.9.8a: Released on October   11th, 2005

    o  OpenSSL 0.9.8:  Released on July       5th, 2005

    o  OpenSSL 0.9.7i: Released on October   15th, 2005

    o  OpenSSL 0.9.7h: Released on October   11th, 2005

    o  OpenSSL 0.9.7g: Released on April     11th, 2005

    o  OpenSSL 0.9.7f: Released on March     22nd, 2005

    o  OpenSSL 0.9.7e: Released on October   25th, 2004

doc/ssl/SSL_CTX_set_options.pod

+1 −1
Original line number Diff line number Diff line
@@ -86,7 +86,7 @@ doing a re-connect, always takes the first cipher in the cipher list. 


=item SSL_OP_MSIE_SSLV2_RSA_PADDING



...

As of OpenSSL 0.9.7h and 0.9.8a, this option has no effect.



=item SSL_OP_SSLEAY_080_CLIENT_DH_BUG

ssl/s23_srvr.c

+1 −6
Original line number Diff line number Diff line
@@ -250,9 +250,6 @@ int ssl23_get_client_hello(SSL *s) 
	int n=0,j;

	int type=0;

	int v[2];

#ifndef OPENSSL_NO_RSA

	int use_sslv2_strong=0;

#endif



	if (s->state ==	SSL23_ST_SR_CLNT_HELLO_A)

		{
@@ -501,9 +498,7 @@ int ssl23_get_client_hello(SSL *s) 
			}



		s->state=SSL2_ST_GET_CLIENT_HELLO_A;

		if ((s->options & SSL_OP_MSIE_SSLV2_RSA_PADDING) ||

			use_sslv2_strong ||

			(s->options & SSL_OP_NO_TLSv1 && s->options & SSL_OP_NO_SSLv3))

		if (s->options & SSL_OP_NO_TLSv1 && s->options & SSL_OP_NO_SSLv3)

			s->s2->ssl2_rollback=0;

		else

			/* reject SSL 2.0 session if client supports SSL 3.0 or TLS 1.0