diff options
| author | Tomas Mraz <tomas@openssl.org> | 2024-06-03 16:46:41 +0200 |
|---|---|---|
| committer | Tomas Mraz <tomas@openssl.org> | 2024-06-04 14:36:37 +0200 |
| commit | ae20c423f9b86956267ea82bd678179e9d648bad (patch) | |
| tree | cbf8b0b5019890b313e5a3b0023f8bf9018506d5 /NEWS.md | |
| parent | Skip newly added blocked OAEP SHAKE testcases with old fips providers (diff) | |
| download | openssl-ae20c423f9b86956267ea82bd678179e9d648bad.tar.xz openssl-ae20c423f9b86956267ea82bd678179e9d648bad.zip | |
Update CHANGES.md and NEWS.md for the upcoming release
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24549)
(cherry picked from commit 6152b08631568551f155f9d8219298f55aef5d94)
Diffstat (limited to 'NEWS.md')
| -rw-r--r-- | NEWS.md | 20 |
1 files changed, 19 insertions, 1 deletions
@@ -33,7 +33,21 @@ This release is in development. OpenSSL 3.3 ----------- -### Major changes between OpenSSL 3.2 and OpenSSL 3.3 [under development] +### Major changes between OpenSSL 3.3.0 and OpenSSL 3.3.1 [under development] + +OpenSSL 3.3.1 is a security patch release. The most severe CVE fixed in this +release is Low. + +This release incorporates the following bug fixes and mitigations: + + * Fixed potential use after free after SSL_free_buffers() is called + ([CVE-2024-4741]) + + * Fixed an issue where checking excessively long DSA keys or parameters may + be very slow + ([CVE-2024-4603]) + +### Major changes between OpenSSL 3.2 and OpenSSL 3.3.0 [9 Apr 2024] OpenSSL 3.3.0 is a feature release adding significant new functionality to OpenSSL. @@ -171,8 +185,10 @@ This release incorporates the following bug fixes and mitigations: * Fixed PKCS12 Decoding crashes ([CVE-2024-0727]) + * Fixed excessive time spent checking invalid RSA public keys ([CVE-2023-6237]) + * Fixed POLY1305 MAC implementation corrupting vector registers on PowerPC CPUs which support PowerISA 2.07 ([CVE-2023-6129]) @@ -1725,6 +1741,8 @@ OpenSSL 0.9.x <!-- Links --> +[CVE-2024-4741]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-4741 +[CVE-2024-4603]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-4603 [CVE-2024-2511]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-2511 [CVE-2024-0727]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-0727 [CVE-2023-6237]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-6237 |