Skip to content
  1. Jul 07, 2015
    • Matt Caswell's avatar
      Fix alternate chains certificate forgery issue · 2aacec8f
      Matt Caswell authored
      
      
      During certificate verfification, OpenSSL will attempt to find an
      alternative certificate chain if the first attempt to build such a chain
      fails. An error in the implementation of this logic can mean that an
      attacker could cause certain checks on untrusted certificates to be
      bypassed, such as the CA flag, enabling them to use a valid leaf
      certificate to act as a CA and "issue" an invalid certificate.
      
      This occurs where at least one cert is added to the first chain from the
      trust store, but that chain still ends up being untrusted. In that case
      ctx->last_untrusted is decremented in error.
      
      Patch provided by the BoringSSL project.
      
      CVE-2015-1793
      
      Reviewed-by: default avatarStephen Henson <steve@openssl.org>
      2aacec8f
    • Richard Levitte's avatar
      Document the nameopt change · 9cf315ef
      Richard Levitte authored
      
      
      Reviewed-by: default avatarRich Salz <rsalz@openssl.org>
      9cf315ef
    • Richard Levitte's avatar
      Make "oneline" the default for nameopt · f1cece55
      Richard Levitte authored
      
      
      There's no reason why we should default to a output format that is
      old, and confusing in some cases.
      
      This affects the commands "ca", "crl", "req" and "x509".
      
      Reviewed-by: default avatarRich Salz <rsalz@openssl.org>
      f1cece55
  2. Jul 06, 2015
  3. Jun 30, 2015
  4. Jun 29, 2015
  5. Jun 28, 2015
  6. Jun 25, 2015
  7. Jun 24, 2015
  8. Jun 23, 2015
  9. Jun 22, 2015
  10. Jun 21, 2015