[ubuntu/lucid-security] openssl 0.9.8k-7ubuntu8.18 (Accepted)

[Marc Deslauriers]

openssl (0.9.8k-7ubuntu8.18) lucid-security; urgency=medium

  * SECURITY UPDATE: MITM via change cipher spec
    - debian/patches/CVE-2014-0224-1.patch: only accept change cipher spec
      when it is expected in ssl/s3_clnt.c, ssl/s3_pkt.c, ssl/s3_srvr.c,
      ssl/ssl3.h.
    - debian/patches/CVE-2014-0224-2.patch: don't accept zero length master
      secrets in ssl/s3_pkt.c.
    - debian/patches/CVE-2014-0224-3.patch: allow CCS after resumption in
      ssl/s3_clnt.c.
    - debian/patches/fix_renegotiation.patch: add upstream commit to fix
      renegotiation in ssl/s3_clnt.c, ssl/t1_lib.c.
    - CVE-2014-0224
  * SECURITY UPDATE: denial of service via DTLS recursion flaw
    - debian/patches/CVE-2014-0221.patch: handle DTLS hello request without
      recursion in ssl/d1_both.c.
    - CVE-2014-0221

Date: 2014-06-04 23:51:12.007180+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
https://launchpad.net/ubuntu/lucid/+source/openssl/0.9.8k-7ubuntu8.18
-------------- next part --------------
Sorry, changesfile not available.