From 4ec53ad6e1791daafbe26bdbd539f2ba9172959a Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Thu, 13 Jul 2023 16:14:49 +0100 Subject: Update CHANGES/NEWS for CVE-2023-3446 Reviewed-by: Paul Dale Reviewed-by: Tom Cosgrove Reviewed-by: Bernd Edlinger Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/21451) --- NEWS.md | 2 ++ 1 file changed, 2 insertions(+) (limited to 'NEWS.md') diff --git a/NEWS.md b/NEWS.md index 7bfc645626..899be2b616 100644 --- a/NEWS.md +++ b/NEWS.md @@ -39,6 +39,7 @@ OpenSSL 3.1 ### Major changes between OpenSSL 3.1.1 and OpenSSL 3.1.2 [under development] + * Fix DH_check() excessive time with over sized modulus ([CVE-2023-3446]) * Do not ignore empty associated data entries with AES-SIV ([CVE-2023-2975]) * When building with the `enable-fips` option and using the resulting FIPS provider, TLS 1.2 will, by default, mandate the use of an @@ -1480,6 +1481,7 @@ OpenSSL 0.9.x +[CVE-2023-3446]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-3446 [CVE-2023-2975]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-2975 [CVE-2023-2650]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-2650 [CVE-2023-1255]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-1255 -- cgit v1.2.3-70-g09d2