root
/
openssl
mirror of https://github.com/openssl/openssl.git
1
0
Fork 0
Code Issues Actions 7 Packages Projects Releases Wiki Activity

Update CHANGES and NEWS for security release 

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit cf9d6685fd)
This commit is contained in:
Neil Horman 2025-02-11 08:36:29 -05:00
parent d3d16e36cc
commit f2a1024cdc
2 changed files with 16 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
CHANGES.md
View File

@ -29,6 +29,17 @@ OpenSSL 3.4
### Changes between 3.4.0 and 3.4.1 [xx XXX xxxx] ### Changes between 3.4.0 and 3.4.1 [xx XXX xxxx]
* Fixed RFC7250 handshakes with unauthenticated servers don't abort as expected.
Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a
server may fail to notice that the server was not authenticated, because
handshakes don't abort as expected when the SSL_VERIFY_PEER verification mode
is set.
([CVE-2024-12797])
*Viktor Dukhovni*
* Fixed timing side-channel in ECDSA signature computation. * Fixed timing side-channel in ECDSA signature computation.
There is a timing signal of around 300 nanoseconds when the top word of There is a timing signal of around 300 nanoseconds when the top word of

6
NEWS.md
View File

@ -24,10 +24,14 @@ OpenSSL 3.4
### Major changes between OpenSSL 3.4.0 and OpenSSL 3.4.1 [under development] ### Major changes between OpenSSL 3.4.0 and OpenSSL 3.4.1 [under development]
This release is in development. OpenSSL 3.4.1 is a security patch release. The most severe CVE fixed in this
release is High.
This release incorporates the following bug fixes and mitigations: This release incorporates the following bug fixes and mitigations:
* Fixed RFC7250 handshakes with unauthenticated servers don't abort as expected.
([CVE-2024-12797])
* Fixed timing side-channel in ECDSA signature computation. * Fixed timing side-channel in ECDSA signature computation.
([CVE-2024-13176]) ([CVE-2024-13176])