From cf9d6685fda656c07fab8527750284f4446a7372 Mon Sep 17 00:00:00 2001 From: Neil Horman Date: Tue, 11 Feb 2025 08:36:29 -0500 Subject: [PATCH] Update CHANGES and NEWS for security release Reviewed-by: Tomas Mraz Reviewed-by: Matt Caswell --- CHANGES.md | 11 +++++++++++ NEWS.md | 6 +++++- 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/CHANGES.md b/CHANGES.md index a91f09279ec..e63c4642835 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -156,6 +156,17 @@ OpenSSL 3.4 ### Changes between 3.4.0 and 3.4.1 [xx XXX xxxx] + * Fixed RFC7250 handshakes with unauthenticated servers don't abort as expected. + + Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a + server may fail to notice that the server was not authenticated, because + handshakes don't abort as expected when the SSL_VERIFY_PEER verification mode + is set. + + ([CVE-2024-12797]) + + *Viktor Dukhovni* + * Fixed timing side-channel in ECDSA signature computation. There is a timing signal of around 300 nanoseconds when the top word of diff --git a/NEWS.md b/NEWS.md index 2808e335a67..aa14f7873eb 100644 --- a/NEWS.md +++ b/NEWS.md @@ -51,10 +51,14 @@ OpenSSL 3.4 ### Major changes between OpenSSL 3.4.0 and OpenSSL 3.4.1 [under development] -This release is in development. +OpenSSL 3.4.1 is a security patch release. The most severe CVE fixed in this +release is High. This release incorporates the following bug fixes and mitigations: + * Fixed RFC7250 handshakes with unauthenticated servers don't abort as expected. + ([CVE-2024-12797]) + * Fixed timing side-channel in ECDSA signature computation. ([CVE-2024-13176]) -- 2.47.2