Add.

1 files changed, 30 insertions, 11 deletions

diff --git a/NEWS b/NEWS
index ee4cf2adcb..4001657e2e 100644
--- a/NEWS
+++ b/NEWS
@@ -5,17 +5,7 @@ See the end for copying conditions.
 
 * Version 2.5.0 (unreleased)
 
-** Fix compiler warnings.
-Reported by Massimo Gaspari <massimo.gaspari@alice.it> in
-<http://permalink.gmane.org/gmane.network.gnutls.general/1281>.
-
-** Fix ordering of -I's to avoid opencdk.h conflict with system headers.
-Reported by Roman Bogorodskiy <novel@FreeBSD.org> in
-<http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/2930>.
-
-** Fix memory leaks when doing a re-handshake.
-Reported by Sam Varshavchik <mrsam@courier-mta.com> in
-<http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/2928>.
+** Port fixes from v2.4.1 release, see below.
 
 ** Added API to replace and update the crypto backend.
 
@@ -32,6 +22,35 @@ gnutls_crypto_rnd_register2: Added
 gnutls_crypto_pk_register2: Added
 gnutls_crypto_bigint_register2: Added
 
+* Version 2.4.1 (released 2008-06-30)
+
+** libgnutls: Fix local crash in gnutls_handshake.  [GNUTLS-SA-2008-2]
+If the gnutls_handshake function is called for a normal session, which
+can happen for re-handshakes, the library would crash because it tried
+to hash some data using a libgcrypt handle that had been deallocated.
+Report and tiny patch from Tomas Mraz <tmraz@redhat.com>.  Any updates
+with more details about this vulnerability will be added to
+<http://www.gnu.org/software/gnutls/security.html>
+
+** libgnutls: Fix memory leaks when doing a re-handshake.
+Reported by Sam Varshavchik <mrsam@courier-mta.com> in
+<http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/2928>.
+
+** Fix compiler warnings.
+Reported by Massimo Gaspari <massimo.gaspari@alice.it> in
+<http://thread.gmane.org/gmane.network.gnutls.general/1281>.
+
+** Fix ordering of -I's to avoid opencdk.h conflict with system headers.
+Reported by Roman Bogorodskiy <novel@FreeBSD.org> in
+<http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/2930>.
+
+** srptool: Fix a problem where --verify check does not succeed.
+Report and tiny patch by Matthias Koenig <mkoenig@suse.de> in
+<http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/2944>.
+
+** API and ABI modifications:
+No changes since last version.
+
 * Version 2.4.0 (released 2008-06-19)
 
 ** Major changes compared to the v2.2 branch: