openssl, branch OpenSSL_1_0_1a TLS/SSL and crypto library. http://git.bktus.com/gpgfrontend/openssl/atom?h=OpenSSL_1_0_1a 2012-04-19T12:17:19Z prepare for 1.0.1a release 2012-04-19T12:17:19Z Dr. Stephen Henson steve@openssl.org 2012-04-19T12:17:19Z urn:sha1:531c6fc8f3bc6c8413a1604562934fa77e49c39f update NEWS 2012-04-19T12:14:28Z Dr. Stephen Henson steve@openssl.org 2012-04-19T12:14:28Z urn:sha1:e011d0a3c4ce21bd127856af5c359ec617a66770 Check for potentially exploitable overflows in asn1_d2i_read_bio 2012-04-19T12:13:59Z Dr. Stephen Henson steve@openssl.org 2012-04-19T12:13:59Z urn:sha1:8d5505d099973a06781b7e0e5b65861859a7d994 BUF_mem_grow and BUF_mem_grow_clean. Refuse attempts to shrink buffer in CRYPTO_realloc_clean. Thanks to Tavis Ormandy, Google Security Team, for discovering this issue and to Adam Langley <agl@chromium.org> for fixing it. (CVE-2012-2110) Makefile.org: clear yet another environment variable [from HEAD]. 2012-04-19T06:40:36Z Andy Polyakov appro@openssl.org 2012-04-19T06:40:36Z urn:sha1:d36e0ee460f41d6b64015455c4f5414a319865c3 PR: 2793 only call FIPS_cipherinit in FIPS mode 2012-04-18T22:41:50Z Dr. Stephen Henson steve@openssl.org 2012-04-18T22:41:50Z urn:sha1:143619ccf6c46f3909223627eb84b488c271ff5a e_rc4_hmac_md5.c: update from HEAD, fixes crash on legacy Intel CPUs. 2012-04-18T17:51:33Z Andy Polyakov appro@openssl.org 2012-04-18T17:51:33Z urn:sha1:9f339d75b59aa6ddc3240f7748dd96b4b01c2186 PR: 2792 update NEWS 2012-04-18T17:30:20Z Dr. Stephen Henson steve@openssl.org 2012-04-18T17:30:20Z urn:sha1:28583660fb5853406f30bd51133c4bb0109bc179 correct error code 2012-04-18T14:53:48Z Dr. Stephen Henson steve@openssl.org 2012-04-18T14:53:48Z urn:sha1:dedfe959dd37cef2abfd559fbc6ce3fd9cc8a843 Disable SHA-2 ciphersuites in < TLS 1.2 connections. 2012-04-17T15:20:17Z Bodo Möller bodo@openssl.org 2012-04-17T15:20:17Z urn:sha1:4d936ace088da7a72e7dc8901cbba64e3c1f3596 (TLS 1.2 clients could end up negotiating these with an OpenSSL server with TLS 1.2 disabled, which is problematic.) Submitted by: Adam Langley Additional workaround for PR#2771 2012-04-17T14:41:23Z Dr. Stephen Henson steve@openssl.org 2012-04-17T14:41:23Z urn:sha1:89bd25eb26bbc2ebceb4cd892e7453337804820c If OPENSSL_MAX_TLS1_2_CIPHER_LENGTH is set then limit the size of client ciphersuites to this value. A value of 50 should be sufficient. Document workarounds in CHANGES.