OpenSSL CHANGES
_______________
+ Changes between 1.0.1g and 1.0.1h [5 Jun 2014]
+
+ *) Fix for SSL/TLS MITM flaw. An attacker using a carefully crafted
+ handshake can force the use of weak keying material in OpenSSL
+ SSL/TLS clients and servers.
+
+ Thanks to KIKUCHI Masashi (Lepidum Co. Ltd.) for discovering and
+ researching this issue. (CVE-2014-0224)
+ [KIKUCHI Masashi, Steve Henson]
+
+ *) Fix DTLS recursion flaw. By sending an invalid DTLS handshake to an
+ OpenSSL DTLS client the code can be made to recurse eventually crashing
+ in a DoS attack.
+
+ Thanks to Imre Rad (Search-Lab Ltd.) for discovering this issue.
+ (CVE-2014-0221)
+ [Imre Rad, Steve Henson]
+
+ *) Fix DTLS invalid fragment vulnerability. A buffer overrun attack can
+ be triggered by sending invalid DTLS fragments to an OpenSSL DTLS
+ client or server. This is potentially exploitable to run arbitrary
+ code on a vulnerable client or server.
+
+ Thanks to Jüri Aedla for reporting this issue. (CVE-2014-0195)
+ [Jüri Aedla, Steve Henson]
+
+ *) Fix bug in TLS code where clients enable anonymous ECDH ciphersuites
+ are subject to a denial of service attack.
+
+ Thanks to Felix Gröbert and Ivan Fratric at Google for discovering
+ this issue. (CVE-2014-3470)
+ [Felix Gröbert, Ivan Fratric, Steve Henson]
+
+ *) Harmonize version and its documentation. -f flag is used to display
+ compilation flags.
+ [mancha <mancha1@zoho.com>]
+
+ *) Fix eckey_priv_encode so it immediately returns an error upon a failure
+ in i2d_ECPrivateKey.
+ [mancha <mancha1@zoho.com>]
+
+ *) Fix some double frees. These are not thought to be exploitable.
+ [mancha <mancha1@zoho.com>]
+
Changes between 1.0.1f and 1.0.1g [7 Apr 2014]
*) A missing bounds check in the handling of the TLS heartbeat extension
* (Prior to 0.9.5a beta1, a different scheme was used: MMNNFFRBB for\r
* major minor fix final patch/beta)\r
*/\r
-#define OPENSSL_VERSION_NUMBER 0x1000107fL\r
+#define OPENSSL_VERSION_NUMBER 0x1000108fL\r
#ifdef OPENSSL_FIPS\r
-#define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1g-fips 7 Apr 2014"\r
+#define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1h-fips 5 Jun 2014"\r
#else\r
-#define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1g 7 Apr 2014"\r
+#define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1h 5 Jun 2014"\r
#endif\r
#define OPENSSL_VERSION_PTEXT " part of " OPENSSL_VERSION_TEXT\r
\r
#define PKCS7_R_ERROR_SETTING_CIPHER 121\r
#define PKCS7_R_INVALID_MIME_TYPE 131\r
#define PKCS7_R_INVALID_NULL_POINTER 143\r
+#define PKCS7_R_INVALID_SIGNED_DATA_TYPE 155\r
#define PKCS7_R_MIME_NO_CONTENT_TYPE 132\r
#define PKCS7_R_MIME_PARSE_ERROR 133\r
#define PKCS7_R_MIME_SIG_PARSE_ERROR 134\r
/* Allow initial connection to servers that don't support RI */\r
#define SSL_OP_LEGACY_SERVER_CONNECT 0x00000004L\r
#define SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG 0x00000008L\r
-#define SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG 0x00000010L\r
+#define SSL_OP_TLSEXT_PADDING 0x00000010L\r
#define SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER 0x00000020L\r
#define SSL_OP_SAFARI_ECDHE_ECDSA_BUG 0x00000040L\r
#define SSL_OP_SSLEAY_080_CLIENT_DH_BUG 0x00000080L\r
\r
/* Hasn't done anything since OpenSSL 0.9.7h, retained for compatibility */\r
#define SSL_OP_MSIE_SSLV2_RSA_PADDING 0x0\r
+/* Refers to ancient SSLREF and SSLv2, retained for compatibility */\r
+#define SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG 0x0\r
\r
/* Disable SSL 3.0/TLS 1.0 CBC vulnerability workaround that was added\r
* in OpenSSL 0.9.6d. Usually (depending on the application protocol)\r
#define TLS1_FLAGS_TLS_PADDING_BUG 0x0008\r
#define TLS1_FLAGS_SKIP_CERT_VERIFY 0x0010\r
#define TLS1_FLAGS_KEEP_HANDSHAKE 0x0020\r
+#define SSL3_FLAGS_CCS_OK 0x0080\r
\r
/* SSL3_FLAGS_SGC_RESTART_DONE is set when we\r
* restart a handshake because of MS SGC and so prevents us\r
This file gives a brief overview of the major changes between each OpenSSL
release. For more details please read the CHANGES file.
+ Major changes between OpenSSL 1.0.1g and OpenSSL 1.0.1h [5 Jun 2014]
+
+ o Fix for CVE-2014-0224
+ o Fix for CVE-2014-0221
+ o Fix for CVE-2014-0195
+ o Fix for CVE-2014-3470
+ o Fix for CVE-2010-5298
+
Major changes between OpenSSL 1.0.1f and OpenSSL 1.0.1g [7 Apr 2014]
o Fix for CVE-2014-0160
- OpenSSL 1.0.1g 7 Apr 2014
+ OpenSSL 1.0.1h 5 Jun 2014
Copyright (c) 1998-2011 The OpenSSL Project
Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
#ifdef ENABLE_PROCESS_PROTECTION\r
// 同梱するOpenSSLのバージョンに合わせてSHA1ハッシュ値を変更すること\r
#if defined(_M_IX86)\r
- // ssleay32.dll 1.0.1g\r
- RegisterTrustedModuleSHA1Hash("\xCB\xBA\x62\x61\x3C\x44\x1E\x94\xD2\xF4\xAD\xD5\x03\x43\x6F\x26\xD2\xAF\x2F\x21");\r
- // libeay32.dll 1.0.1g\r
- RegisterTrustedModuleSHA1Hash("\x4E\x53\x29\xC4\x32\x1B\x17\xA5\x4D\x40\xDF\x6F\xF6\xD2\x53\x7E\xBC\x54\x69\x1B");\r
+ // ssleay32.dll 1.0.1h\r
+ RegisterTrustedModuleSHA1Hash("\x1B\x27\x4E\x29\x14\x78\x72\x0D\x33\x73\xD5\x98\xCF\xEA\x32\x07\x2B\x35\x69\x66");\r
+ // libeay32.dll 1.0.1h\r
+ RegisterTrustedModuleSHA1Hash("\x1D\x2E\x70\x49\x84\x2C\xE9\x1F\x64\xE8\x84\xD4\x62\x5B\xF4\x34\x9A\x0F\x82\xFC");\r
#elif defined(_M_AMD64)\r
- // ssleay32.dll 1.0.1g\r
- RegisterTrustedModuleSHA1Hash("\x10\x08\xFE\x10\x3A\xB2\xEC\x9E\x13\xAF\x29\xD7\xF4\xFC\x90\xE3\x9B\x8D\xAF\x12");\r
- // libeay32.dll 1.0.1g\r
- RegisterTrustedModuleSHA1Hash("\x30\x42\xCF\x84\x2B\x3F\x17\x3B\xF7\x97\xA5\x2B\x5F\x1A\x5A\xA2\x04\x02\x92\x92");\r
+ // ssleay32.dll 1.0.1h\r
+ RegisterTrustedModuleSHA1Hash("\xB7\x5C\x31\xF3\x28\x73\xA0\x3C\x33\xDD\xBC\xB5\x8F\xD1\x38\xB6\xCE\x67\x4C\x40");\r
+ // libeay32.dll 1.0.1h\r
+ RegisterTrustedModuleSHA1Hash("\x5E\xBF\x56\x8C\xED\x06\xE8\x90\xE3\xC0\x3B\x6C\x51\x66\x4F\xC9\x9F\x1F\xF5\x89");\r
#endif\r
#endif\r
g_hOpenSSL = LoadLibrary("ssleay32.dll");\r
OSDN Git Service
