=================================================================== RCS file: /cvsrepo/anoncvs/cvs/www/69.html,v retrieving revision 1.38 retrieving revision 1.39 diff -u -r1.38 -r1.39 --- www/69.html 2021/04/15 14:06:07 1.38 +++ www/69.html 2021/04/15 15:46:01 1.39 @@ -1114,13 +1114,15 @@ -
  • LibreSSL 3.2.5 +
  • LibreSSL 3.3.3
  • Compatibility Changes
  • Testing and Proactive Security @@ -1216,12 +1241,16 @@
  • Malformed ASN.1 in a certificate revocation list or a timestamp response token can lead to a NULL pointer dereference. -
  • Pull in fix for EVP_CipherUpdate() overflow from OpenSSL. +
  • Pull in fix for + EVP_CipherUpdate(3) + overflow from OpenSSL.
  • Use EXFLAG_INVALID to handle out of memory and parse errors in x509v3_cache_extensions(). -
  • Refactor and clean up ocspcheck(8) and add regression tests. +
  • Refactor and clean up + ocspcheck(8) + and add regression tests.
  • Internal Improvements @@ -1356,7 +1385,8 @@
  • Add tls12_record_protection_unused() and call it from CCS functions.
  • Move key/IV length checks closer to usage sites. Also add explicit - checks against EVP_CIPHER_{iv,key}_length(). + checks against + EVP_CIPHER_{iv,key}_length().
  • Replace two handrolled tls12_record_protection_engaged(). @@ -1409,8 +1439,10 @@
  • Move point-on-curve check to set_affine_coordinates to avoid verifying ECDSA signatures with unchecked public keys. -
  • Fix SSL_is_server() to behave as documented by re-introducing the - client-specific methods. +
  • Fix + SSL_is_server(3) + to behave as documented by re-introducing the client-specific + methods.
  • Avoid undefined behavior due to memcpy(NULL, NULL, 0). @@ -1425,8 +1457,10 @@
  • Destroy the mutex in a tls_config object on tls_config_free().
  • Free alert_data and phh_data in tls13_record_layer_free() - these could leak if SSL_shutdown() or tls_close() were called - after closing the underlying socket(). + these could leak if + SSL_shutdown(3) + or tls_close(3) + were called after closing the underlying socket().
  • Gracefully handle root certificates being both trusted and untrusted. @@ -1462,9 +1496,11 @@
  • Avoid passing last and depth to x509_verify_cert_error() on ENOMEM.
  • Fix two bugs in the legacy verifier that resulted from refactoring - of X509_verify_cert() for the new verifier: a return value was - incorrectly treated as boolean, making it insufficient to decide - whether validation should carry on or not. + of + X509_verify_cert(3) + for the new verifier: a return value was incorrectly treated as + boolean, making it insufficient to decide whether validation should + carry on or not.
  • Fix checks for memory caps of constraints names. There are internal caps on the number of name constraints and other names, that the new @@ -1514,14 +1550,22 @@
  • Use the X509_STORE_CTX get_issuer() callback from the new X.509 verifier to fix hashed certificate directories. -
  • Only check BIO_should_read() on read and BIO_should_write() on - write. Previously, BIO_should_write() was also checked after read - and BIO_should_read() after write which could cause stalls in - software that uses the same BIO for read and write. +
  • Only check + BIO_should_read(3) + on read and + BIO_should_write(3) + on write. Previously, + BIO_should_write(3) + was also checked after read and + BIO_should_read(3) + after write which could cause stalls in software that uses the same + BIO for read and write. -
  • In openssl(1) verify, also check for error on the store context - since the return value of X509_verify_cert() is unreliable in - presence of a callback that returns 1 too often. +
  • In openssl(1) + verify, also check for error on the store context since the return + value of + X509_verify_cert(3) + is unreliable in presence of a callback that returns 1 too often.
  • Handle additional certificate error cases in the new X.509 verifier. Keep track of the errors encountered if a verify callback tells the @@ -1534,7 +1578,7 @@ error code.
  • Plug a large memory leak in the new verifier caused by calling - X509_policy_check() repeatedly. + X509_policy_check(3) repeatedly.
  • Avoid leaking memory in x509_verify_chain_dup().