Renegotiation DOS

2013-09-26 Thread Rajeswari K
Hello Openssl-dev team, Currently am checking whether Renegotiation is enabled in openssl 0.9.8q version. If enabled, would like to disable this. As per release note, i see *Changes between 0.9.8k and 0.9.8l [5 Nov 2009]* *) Disable renegotiation completely - this fixes a severe security

Re: FIPS OpenSSL default DRBG continuous test failing

2013-09-26 Thread David Jacobson
I'm an expert on random number generators and knowledgeable about FIPS 140. But I'm not knowledegable about the RNG facilities on OpenSSL. In general you don't set the entropy, rather you set up an entropy source. However, some systems do allow running on a fixed input string. But the design

[openssl.org #3132] Query related to d2i_X509 and X509_free

2013-09-26 Thread Sandeepa SHARMA via RT
Hi, We are using openssl-1.0.0e. I am facing a memory leak of 98 bytes when I use d2i_X509() function. This memory leak is seen even if d2i_X509() return NULL. I couldn't find the source code for d2i_X509() and X509_free() function. Can you please help me in this. int

Design change observed at ssl3_get_client_certificate()

2013-09-26 Thread Rajeswari K
Hello Openssl dev team, Currently we are using openssl 0.9.8q version. Earlier we have used openssl 0.9.8k. We have seen change in the return value handling of ssl_verify_cert_chain() at function ssl3_get_client_certificate(). At openssl 0.9.8k, ssl_verify_cert_chain() is handled like this

Re: Design change observed at ssl3_get_client_certificate()

2013-09-26 Thread Rajeswari K
Sorry team. Change observed between openssl 0.9.8g to openssl0.9.8k Can you please tell us the intent of this change and how we can get out of this problem. Regards, Rajeswari On Thu, Sep 26, 2013 at 3:18 PM, Rajeswari K raji.kotamr...@gmail.comwrote: Hello Openssl dev team, Currently we

Patch for Correct fix for CVE-2013-0169 for openssl-.0.9.8y

2013-09-26 Thread Costas Stasimos
Hello! I'm currenty working with openssl-0.9.8.y. As we can see in the changelog in the official openssl page there is a correct fix concerning the CVE-2013-0169 which is only available at version openssl-1.0.1.e. My question is when do you plan to included this change at the series 0.9.8?? Is

[openssl.org #3133] minor make install improvement for Windows/Visual Studio in ms\nt.mak

2013-09-26 Thread Kees Dekker via RT
Hi, It may be useful to add the .pdb file to the lib directory in the install target. Windows build that adopt OpenSSL may benefit from it. When using ssleay32.lib and/or libeay32.lib then Visual Studio may complain about missing symbol information. That information is in the pdb file. If a