mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2025-02-23 14:42:15 +08:00
Code Issues Packages Projects Releases Wiki Activity

Update CHANGES and NEWS for security release

Browse Source 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
This commit is contained in:
Neil Horman 2025-02-11 08:36:29 -05:00
parent 739c4b2e92
commit cf9d6685fd
2 changed files with 16 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
CHANGES.md
View File

@ -156,6 +156,17 @@ OpenSSL 3.4
### Changes between 3.4.0 and 3.4.1 [xx XXX xxxx]
* Fixed RFC7250 handshakes with unauthenticated servers don't abort as expected.
Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a
server may fail to notice that the server was not authenticated, because
handshakes don't abort as expected when the SSL_VERIFY_PEER verification mode
is set.
([CVE-2024-12797])
*Viktor Dukhovni*
* Fixed timing side-channel in ECDSA signature computation.
There is a timing signal of around 300 nanoseconds when the top word of

6
NEWS.md
View File

@ -51,10 +51,14 @@ OpenSSL 3.4
### Major changes between OpenSSL 3.4.0 and OpenSSL 3.4.1 [under development]
This release is in development.
OpenSSL 3.4.1 is a security patch release. The most severe CVE fixed in this
release is High.
This release incorporates the following bug fixes and mitigations:
* Fixed RFC7250 handshakes with unauthenticated servers don't abort as expected.
([CVE-2024-12797])
* Fixed timing side-channel in ECDSA signature computation.
([CVE-2024-13176])