From 2256dedfec66f2bb6841444e342a15a3144536e4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bodo=20M=C3=B6ller?= Date: Thu, 26 Nov 2009 18:39:21 +0000 Subject: Import corrected CHANGES file from OpenSSL_0_9_8-stable (as far as applicable for this branch) --- CHANGES | 17 ++++------------- 1 file changed, 4 insertions(+), 13 deletions(-) diff --git a/CHANGES b/CHANGES index 3c9f51c5b7..bc8cc2b7a1 100644 --- a/CHANGES +++ b/CHANGES @@ -96,6 +96,10 @@ Changes between 0.9.8h and 0.9.8i [15 Sep 2008] + *) Fix NULL pointer dereference if a DTLS server received + ChangeCipherSpec as first record (CVE-2009-1386). + [PR #1679] + *) Fix a state transitition in s3_srvr.c and d1_srvr.c (was using SSL3_ST_CW_CLNT_HELLO_B, should be ..._ST_SW_SRVR_...). [Nagendra Modadugu] @@ -1499,19 +1503,6 @@ differing sizes. [Richard Levitte] - Changes between 0.9.7m and 0.9.7n [xx XXX xxxx] - - *) In the SSL/TLS server implementation, be strict about session ID - context matching (which matters if an application uses a single - external cache for different purposes). Previously, - out-of-context reuse was forbidden only if SSL_VERIFY_PEER was - set. This did ensure strict client verification, but meant that, - with applications using a single external cache for quite - different requirements, clients could circumvent ciphersuite - restrictions for a given session ID context by starting a session - in a different context. - [Bodo Moeller] - Changes between 0.9.7l and 0.9.7m [23 Feb 2007] *) Cleanse PEM buffers before freeing them since they may contain -- cgit v1.2.1