Skip to content
  1. Jun 05, 2014
    • Dr. Stephen Henson's avatar
      Update CHANGES and NEWS · aabbe99f
      Dr. Stephen Henson authored
      aabbe99f
    • Dr. Stephen Henson's avatar
      Fix CVE-2014-3470 · 8011cd56
      Dr. Stephen Henson authored
      Check session_cert is not NULL before dereferencing it.
      8011cd56
    • Dr. Stephen Henson's avatar
      Fix CVE-2014-0221 · d3152655
      Dr. Stephen Henson authored
      Unnecessary recursion when receiving a DTLS hello request can be used to
      crash a DTLS client. Fixed by handling DTLS hello request without recursion.
      
      Thanks to Imre Rad (Search-Lab Ltd.) for discovering this issue.
      d3152655
    • Dr. Stephen Henson's avatar
      Additional CVE-2014-0224 protection. · 006cd708
      Dr. Stephen Henson authored
      Return a fatal error if an attempt is made to use a zero length
      master secret.
      006cd708
    • Dr. Stephen Henson's avatar
      Fix for CVE-2014-0224 · bc8923b1
      Dr. Stephen Henson authored
      Only accept change cipher spec when it is expected instead of at any
      time. This prevents premature setting of session keys before the master
      secret is determined which an attacker could use as a MITM attack.
      
      Thanks to KIKUCHI Masashi (Lepidum Co. Ltd.) for reporting this issue
      and providing the initial fix this patch is based on.
      bc8923b1
    • Dr. Stephen Henson's avatar
      Fix for CVE-2014-0195 · 1632ef74
      Dr. Stephen Henson authored
      A buffer overrun attack can be triggered by sending invalid DTLS fragments
      to an OpenSSL DTLS client or server. This is potentially exploitable to
      run arbitrary code on a vulnerable client or server.
      
      Fixed by adding consistency check for DTLS fragments.
      
      Thanks to Jüri Aedla for reporting this issue.
      1632ef74
    • Dr. Stephen Henson's avatar
      make update · f1f4fbde
      Dr. Stephen Henson authored
      f1f4fbde
  2. Jun 03, 2014
  3. Jun 02, 2014
  4. Jun 01, 2014
  5. May 31, 2014
  6. May 30, 2014
  7. May 29, 2014
  8. May 27, 2014
  9. May 26, 2014
  10. May 25, 2014
  11. May 24, 2014
  12. May 22, 2014
  13. May 21, 2014
  14. May 20, 2014
  15. May 19, 2014
  16. May 15, 2014