: Log in!

メインメニュー
Google


ウェブ 検索
サイト内検索
トップ  >  Linux12歩  >  2012-03-25 opensslのupdate
20120325 openssl-1.0.0hにupdateしました


Changes

Changes between 1.0.0g and 1.0.0h [12 Mar 2012]

*) Fix MMA (Bleichenbacher's attack on PKCS #1 v1.5 RSA padding) weakness
   in CMS and PKCS7 code. When RSA decryption fails use a random key for
   content decryption and always return the same error. Note: this attack
   needs on average 2^20 messages so it only affects automated senders. The
   old behaviour can be reenabled in the CMS code by setting the
   CMS_DEBUG_DECRYPT flag: this is useful for debugging and testing where
   an MMA defence is not necessary.
   Thanks to Ivan Nestlerode <inestlerode at us.ibm.com> for discovering
   this issue. (CVE-2012-0884)
   [Steve Henson]

*) Fix CVE-2011-4619: make sure we really are receiving a 
   client hello before rejecting multiple SGC restarts. Thanks to
   Ivan Nestlerode <inestlerode at us.ibm.com> for discovering this bug.
   [Steve Henson]
投票数:42 平均点:5.48
前
2012-03-23 mysqlのupdate
カテゴリートップ
Linux12歩
次
2012-03-29 iptablesのupdate