Update CHANGES and NEWS for security release

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>

diff --git a/CHANGES.md b/CHANGES.md
index a91f09279ecd69cff8c8a0bf5473cb6bd8f89c24..e63c464283559b18202c5eebde21f3ab37c4db3b 100644 (file)
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -156,6 +156,17 @@ OpenSSL 3.4
 
 ### Changes between 3.4.0 and 3.4.1 [xx XXX xxxx]
 
+ * Fixed RFC7250 handshakes with unauthenticated servers don't abort as expected.
+
+   Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a
+   server may fail to notice that the server was not authenticated, because
+   handshakes don't abort as expected when the SSL_VERIFY_PEER verification mode
+   is set.
+
+   ([CVE-2024-12797])
+
+   *Viktor Dukhovni*
+
  * Fixed timing side-channel in ECDSA signature computation.
 
    There is a timing signal of around 300 nanoseconds when the top word of

diff --git a/NEWS.md b/NEWS.md
index 2808e335a67635f12ac7545028e48a23532389dd..aa14f7873ebb54eda9666fc437fa016bb94a371f 100644 (file)
--- a/NEWS.md
+++ b/NEWS.md
@@ -51,10 +51,14 @@ OpenSSL 3.4
 
 ### Major changes between OpenSSL 3.4.0 and OpenSSL 3.4.1 [under development]
 
-This release is in development.
+OpenSSL 3.4.1 is a security patch release. The most severe CVE fixed in this
+release is High.
 
 This release incorporates the following bug fixes and mitigations:
 
+  * Fixed RFC7250 handshakes with unauthenticated servers don't abort as expected.
+    ([CVE-2024-12797])
+
   * Fixed timing side-channel in ECDSA signature computation.
     ([CVE-2024-13176])