-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2010-8742 2010-05-19 18:34:05 --------------------------------------------------------------------------------
Name : openssl Product : Fedora 12 Version : 1.0.0 Release : 4.fc12 URL : http://www.openssl.org/ Summary : A general purpose cryptography library with TLS implementation Description : The OpenSSL toolkit provides support for secure communications between machines. OpenSSL includes a certificate management tool and shared libraries which provide various cryptographic algorithms and protocols. -------------------------------------------------------------------------------- Update Information: This update fixes multiple bugs and security issues. It especially adds support for RFC5746. -------------------------------------------------------------------------------- ChangeLog: * Tue May 18 2010 Tomas Mraz <[email protected]> 1.0.0-4 - make CA dir readable - the private keys are in private subdir (#584810) - do not move the libcrypto to /lib in the F12 package * Fri Apr 9 2010 Tomas Mraz <[email protected]> 1.0.0-3 - a few fixes from upstream CVS - move libcrypto to /lib (#559953) * Tue Apr 6 2010 Tomas Mraz <[email protected]> 1.0.0-2 - set UTC timezone on pod2man run (#578842) - make X509_NAME_hash_old work in FIPS mode * Tue Mar 30 2010 Tomas Mraz <[email protected]> 1.0.0-1 - update to final 1.0.0 upstream release * Tue Feb 16 2010 Tomas Mraz <[email protected]> 1.0.0-0.22.beta5 - make TLS work in the FIPS mode * Fri Feb 12 2010 Tomas Mraz <[email protected]> 1.0.0-0.21.beta5 - gracefully handle zero length in assembler implementations of OPENSSL_cleanse (#564029) - do not fail in s_server if client hostname not resolvable (#561260) * Wed Jan 20 2010 Tomas Mraz <[email protected]> 1.0.0-0.20.beta5 - new upstream release * Thu Jan 14 2010 Tomas Mraz <[email protected]> 1.0.0-0.19.beta4 - fix CVE-2009-4355 - leak in applications incorrectly calling CRYPTO_free_all_ex_data() before application exit (#546707) - upstream fix for future TLS protocol version handling * Wed Jan 13 2010 Tomas Mraz <[email protected]> 1.0.0-0.18.beta4 - add support for Intel AES-NI * Thu Jan 7 2010 Tomas Mraz <[email protected]> 1.0.0-0.17.beta4 - upstream fix compression handling on session resumption - various null checks and other small fixes from upstream - upstream changes for the renegotiation info according to the latest draft * Mon Nov 23 2009 Tomas Mraz <[email protected]> 1.0.0-0.16.beta4 - fix non-fips mingw build (patch by Kalev Lember) - add IPV6 fix for DTLS * Fri Nov 20 2009 Tomas Mraz <[email protected]> 1.0.0-0.15.beta4 - add better error reporting for the unsafe renegotiation * Fri Nov 20 2009 Tomas Mraz <[email protected]> 1.0.0-0.14.beta4 - fix build on s390x * Wed Nov 18 2009 Tomas Mraz <[email protected]> 1.0.0-0.13.beta4 - disable enforcement of the renegotiation extension on the client (#537962) - add fixes from the current upstream snapshot * Fri Nov 13 2009 Tomas Mraz <[email protected]> 1.0.0-0.12.beta4 - keep the beta status in version number at 3 so we do not have to rebuild openssh and possibly other dependencies with too strict version check * Thu Nov 12 2009 Tomas Mraz <[email protected]> 1.0.0-0.11.beta4 - update to new upstream version, no soname bump needed - fix CVE-2009-3555 - note that the fix is bypassed if SSL_OP_ALL is used so the compatibility with unfixed clients is not broken. The protocol extension is also not final. -------------------------------------------------------------------------------- References: [ 1 ] Bug #570924 - CVE-2009-3245 openssl: missing bn_wexpand return value checks https://bugzilla.redhat.com/show_bug.cgi?id=570924 [ 2 ] Bug #533125 - CVE-2009-3555 TLS: MITM attacks via session renegotiation https://bugzilla.redhat.com/show_bug.cgi?id=533125 [ 3 ] Bug #569774 - CVE-2010-0433 openssl: crash caused by a missing krb5_sname_to_principal() return value check https://bugzilla.redhat.com/show_bug.cgi?id=569774 [ 4 ] Bug #576584 - CVE-2010-0740 openssl: "Record of death" vulnerability in 0.9.8f through 0.9.8m https://bugzilla.redhat.com/show_bug.cgi?id=576584 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update openssl' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/. All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list [email protected] https://admin.fedoraproject.org/mailman/listinfo/package-announce
