root
/
openssl
mirror of https://github.com/openssl/openssl.git
1
0
Fork 0
Code Issues Actions 7 Packages Projects Releases Wiki Activity

Updated CHANGES and NEWS for CVE-2024-6119 fix 

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(cherry picked from commit cf384d35aa)
This commit is contained in:
Viktor Dukhovni 2024-07-10 19:50:57 +10:00 committed by Tomas Mraz
parent 06d1dc3fa9
commit c3f90ac6e2
2 changed files with 17 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
CHANGES.md
View File

@ -30,7 +30,17 @@ breaking changes, and mappings for the large list of deprecated functions.
### Changes between 3.0.14 and 3.0.15 [xx XXX xxxx]
* none yet
* Fixed possible denial of service in X.509 name checks.
Applications performing certificate name checks (e.g., TLS clients checking
server certificates) may attempt to read an invalid memory address when
comparing the expected name with an `otherName` subject alternative name of
an X.509 certificate. This may result in an exception that terminates the
application program.
[(CVE-2024-6119)]
*Viktor Dukhovni*
### Changes between 3.0.13 and 3.0.14 [4 Jun 2024]
@ -19902,6 +19912,7 @@ ndif
<!-- Links -->
[CVE-2024-6119]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-6119
[CVE-2024-4741]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-4741
[CVE-2024-4603]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-4603
[CVE-2024-2511]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-2511

6
NEWS.md
View File

@ -20,7 +20,10 @@ OpenSSL 3.0
### Major changes between OpenSSL 3.0.14 and OpenSSL 3.0.15 [under development]
* none
OpenSSL 3.3.2 is a security patch release. The most severe CVE fixed in this
release is Moderate.
* Fixed possible denial of service in X.509 name checks [(CVE-2024-6119)].
### Major changes between OpenSSL 3.0.13 and OpenSSL 3.0.14 [4 Jun 2024]
@ -1486,6 +1489,7 @@ OpenSSL 0.9.x
<!-- Links -->
[CVE-2024-6119]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-6119
[CVE-2024-4741]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-4741
[CVE-2024-4603]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-4603
[CVE-2024-2511]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-2511