Lines Matching +full:enable +full:- +full:weak +full:- +full:ssl +full:- +full:ciphers
8 ----------------
10 - [OpenSSL 3.0](#openssl-30)
11 - [OpenSSL 1.1.1](#openssl-111)
12 - [OpenSSL 1.1.0](#openssl-110)
13 - [OpenSSL 1.0.2](#openssl-102)
14 - [OpenSSL 1.0.1](#openssl-101)
15 - [OpenSSL 1.0.0](#openssl-100)
16 - [OpenSSL 0.9.x](#openssl-09x)
19 -----------
21 ([CVE-2023-4807])
22 * Fix excessive time spent checking DH q parameter value ([CVE-2023-3817])
23 * Fix DH_check() excessive time with over sized modulus ([CVE-2023-3446])
24 * Do not ignore empty associated data entries with AES-SIV ([CVE-2023-2975])
26 IDENTIFIER sub-identities. ([CVE-2023-2650])
27 * Fixed documentation of X509_VERIFY_PARAM_add0_policy() ([CVE-2023-0466])
28 * Fixed buffer overread in AES-XTS decryption on ARM 64 bit platforms
29 ([CVE-2023-1255])
36 ([CVE-2022-3786]) and ([CVE-2022-3602])
40 * Fix for custom ciphers to prevent accidental use of NULL encryption
41 ([CVE-2022-3358])
46 ([CVE-2022-2274])
47 * Fixed AES OCB failure to encrypt some bytes on 32-bit x86 platforms
48 ([CVE-2022-2097])
54 ([CVE-2022-2068])
59 metacharacters to prevent command injection ([CVE-2022-1292])
61 certificate on an OCSP response ([CVE-2022-1343])
62 * Fixed a bug where the RC4-MD5 ciphersuite incorrectly used the
63 AAD data as the MAC key ([CVE-2022-1434])
65 occuppied by the removed hash table entries ([CVE-2022-1473])
70 for non-prime moduli ([CVE-2022-0778])
75 ([CVE-2021-4044])
86 * Moved all variations of the EVP ciphers CAST5, BF, IDEA, SEED, RC2,
88 * Moved the EVP digests MD2, MD4, MDC2, WHIRLPOOL and RIPEMD-160 to the legacy
101 a non-default `OSSL_LIB_CTX`.
109 * enable-crypto-mdebug and enable-crypto-mdebug-backtrace were mostly
110 disabled; the project uses address sanitize/leak-detect instead.
117 connections via HTTP(s) proxies, connections and exchange via user-defined
119 * Added util/check-format.pl for checking adherence to the coding guidelines.
130 * Add OPENSSL_info() and 'openssl info' to get built-in data.
142 * All of the low-level MD2, MD4, MD5, MDC2, RIPEMD160, SHA1, SHA224,
145 * All of the low-level AES, Blowfish, Camellia, CAST, DES, IDEA, RC2,
147 * All of the low-level DH, DSA, ECDH, ECDSA and RSA public key functions
149 * SSL 3, TLS 1.0, TLS 1.1, and DTLS 1.0 only work at security level 0,
155 -------------
159 * Fixed an SM2 Decryption Buffer Overflow ([CVE-2021-3711])
160 * Fixed various read buffer overruns processing ASN.1 strings ([CVE-2021-3712])
165 X509_V_FLAG_X509_STRICT flag ([CVE-2021-3450])
167 crafted renegotiation ClientHello message from a client ([CVE-2021-3449])
172 function ([CVE-2021-23841])
176 EVP_DecryptUpdate functions ([CVE-2021-23840])
181 * Fixed NULL pointer deref in GENERAL_NAME_cmp ([CVE-2020-1971])
187 * Enable 'MinProtocol' and 'MaxProtocol' to configure both TLS and DTLS
193 * Fixed segmentation fault in SSL_check_chain() ([CVE-2020-1967])
202 used in exponentiation with 512-bit moduli ([CVE-2019-1551])
206 * Fixed a fork protection issue ([CVE-2019-1549])
208 ([CVE-2019-1563])
209 * For built-in EC curves, ensure an EC_GROUP built from the curve name is
212 ([CVE-2019-1547])
216 * Use Windows installation paths in the mingw builds ([CVE-2019-1552])
223 * Prevent over long nonces in ChaCha20-Poly1305 ([CVE-2019-1543])
227 * Change the info callback signals for the start and end of a post-handshake
234 * Timing vulnerability in DSA signature generation ([CVE-2018-0734])
235 * Timing vulnerability in ECDSA signature generation ([CVE-2018-0735])
241 * Early data (0-RTT)
242 * Post-handshake authentication and key update
246 * RSA-PSS signature algorithms (backported to TLSv1.2)
256 * The default RAND method now utilizes an AES-CTR DRBG according to
257 NIST standard SP 800-90Ar1.
260 * The DRBG instances are fork-safe.
269 * Multi-prime RSA
275 * Significant Side-Channel attack security improvements
276 * Add a new ClientHello callback to provide the ability to adjust the SSL
288 -------------
293 ([CVE-2019-1563])
294 * For built-in EC curves, ensure an EC_GROUP built from the curve name is
297 ([CVE-2019-1547])
298 * Use Windows installation paths in the mingw builds ([CVE-2019-1552])
302 * Prevent over long nonces in ChaCha20-Poly1305 ([CVE-2019-1543])
306 * Timing vulnerability in DSA signature generation ([CVE-2018-0734])
307 * Timing vulnerability in ECDSA signature generation ([CVE-2018-0735])
311 * Client DoS due to large DH parameter ([CVE-2018-0732])
312 * Cache timing vulnerability in RSA Key Generation ([CVE-2018-0737])
317 stack ([CVE-2018-0739])
318 * Incorrect CRYPTO_memcmp on HP-UX PA-RISC ([CVE-2018-0733])
319 * rsaz_1024_mul_avx2 overflow bug on x86_64 ([CVE-2017-3738])
323 * bn_sqrx8x_internal carry bug on x86_64 ([CVE-2017-3736])
324 * Malformed X.509 IPAddressFamily could cause OOB read ([CVE-2017-3735])
328 * config now recognises 64-bit mingw and chooses mingw64 instead of mingw
332 * Encrypt-Then-Mac renegotiation crash ([CVE-2017-3733])
336 * Truncated packet could crash via OOB read ([CVE-2017-3731])
337 * Bad (EC)DHE parameters cause a client crash ([CVE-2017-3730])
338 * BN_mod_exp may produce incorrect results on x86_64 ([CVE-2017-3732])
342 * ChaCha20/Poly1305 heap-buffer-overflow ([CVE-2016-7054])
343 * CMS Null dereference ([CVE-2016-7053])
344 * Montgomery multiplication may produce incorrect results ([CVE-2016-7055])
348 * Fix Use After Free for large message sizes ([CVE-2016-6309])
352 * OCSP Status Request extension unbounded memory growth ([CVE-2016-6304])
353 * SSL_peek() hang on empty record ([CVE-2016-6305])
355 ([CVE-2016-6307])
357 ([CVE-2016-6308])
384 * SSL/TLS state machine, version negotiation and record layer rewritten
389 relative to the latest release via the "no-deprecated" Configure
390 argument, or via the "--api=1.1.0|1.0.0|0.9.8" option.
391 * Application software can be compiled with -DOPENSSL_API_COMPAT=version
394 * Change of Configure to use --prefix as the main installation
395 directory location rather than --openssldir. The latter becomes
408 -------------
413 ([CVE-2019-1563])
414 * For built-in EC curves, ensure an EC_GROUP built from the curve name is
417 ([CVE-2019-1547])
419 ([CVE-2019-1552])
427 * 0-byte record padding oracle ([CVE-2019-1559])
431 * Microarchitecture timing vulnerability in ECC scalar multiplication ([CVE-2018-5407])
432 * Timing vulnerability in DSA signature generation ([CVE-2018-0734])
436 * Client DoS due to large DH parameter ([CVE-2018-0732])
437 * Cache timing vulnerability in RSA Key Generation ([CVE-2018-0737])
442 stack ([CVE-2018-0739])
446 * Read/write after SSL object in error state ([CVE-2017-3737])
447 * rsaz_1024_mul_avx2 overflow bug on x86_64 ([CVE-2017-3738])
451 * bn_sqrx8x_internal carry bug on x86_64 ([CVE-2017-3736])
452 * Malformed X.509 IPAddressFamily could cause OOB read ([CVE-2017-3735])
456 * config now recognises 64-bit mingw and chooses mingw64 instead of mingw
460 * Truncated packet could crash via OOB read ([CVE-2017-3731])
461 * BN_mod_exp may produce incorrect results on x86_64 ([CVE-2017-3732])
462 * Montgomery multiplication may produce incorrect results ([CVE-2016-7055])
466 * Missing CRL sanity check ([CVE-2016-7052])
470 * OCSP Status Request extension unbounded memory growth ([CVE-2016-6304])
471 * SWEET32 Mitigation ([CVE-2016-2183])
472 * OOB write in MDC2_Update() ([CVE-2016-6303])
473 * Malformed SHA512 ticket DoS ([CVE-2016-6302])
474 * OOB write in BN_bn2dec() ([CVE-2016-2182])
475 * OOB read in TS_OBJ_print_bio() ([CVE-2016-2180])
476 * Pointer arithmetic undefined behaviour ([CVE-2016-2177])
477 * Constant time flag not preserved in DSA signing ([CVE-2016-2178])
478 * DTLS buffered message DoS ([CVE-2016-2179])
479 * DTLS replay protection DoS ([CVE-2016-2181])
480 * Certificate message OOB reads ([CVE-2016-6306])
484 * Prevent padding oracle in AES-NI CBC MAC check ([CVE-2016-2107])
485 * Fix EVP_EncodeUpdate overflow ([CVE-2016-2105])
486 * Fix EVP_EncryptUpdate overflow ([CVE-2016-2106])
487 * Prevent ASN.1 BIO excessive memory allocation ([CVE-2016-2109])
488 * EBCDIC overread ([CVE-2016-2176])
493 * Only remove the SSLv2 methods with the no-ssl2-method option.
497 * Disable weak ciphers in SSLv3 and up in default builds of OpenSSL.
498 * Disable SSLv2 default build, default negotiation and weak ciphers
499 ([CVE-2016-0800])
500 * Fix a double-free in DSA code ([CVE-2016-0705])
502 ([CVE-2016-0798])
504 ([CVE-2016-0797])
505 * Fix memory issues in BIO_*printf functions ([CVE-2016-0799])
506 * Fix side channel attack on modular exponentiation ([CVE-2016-0702])
510 * DH small subgroups ([CVE-2016-0701])
511 * SSLv2 doesn't block disabled ciphers ([CVE-2015-3197])
515 * BN_mod_exp may produce incorrect results on x86_64 ([CVE-2015-3193])
516 * Certificate verify crash with missing PSS parameter ([CVE-2015-3194])
517 * X509_ATTRIBUTE memory leak ([CVE-2015-3195])
524 * Alternate chains certificate forgery ([CVE-2015-1793])
525 * Race condition handling PSK identify hint ([CVE-2015-3196])
533 * Malformed ECParameters causes infinite loop ([CVE-2015-1788])
534 * Exploitable out-of-bounds read in X509_cmp_time ([CVE-2015-1789])
535 * PKCS7 crash with missing EnvelopedContent ([CVE-2015-1790])
536 * CMS verify infinite loop with unknown hash function ([CVE-2015-1792])
537 * Race condition handling NewSessionTicket ([CVE-2015-1791])
541 * OpenSSL 1.0.2 ClientHello sigalgs DoS fix ([CVE-2015-0291])
542 * Multiblock corrupted pointer fix ([CVE-2015-0290])
543 * Segmentation fault in DTLSv1_listen fix ([CVE-2015-0207])
544 * Segmentation fault in ASN1_TYPE_cmp fix ([CVE-2015-0286])
545 * Segmentation fault for invalid PSS parameters fix ([CVE-2015-0208])
546 * ASN.1 structure reuse memory corruption fix ([CVE-2015-0287])
547 * PKCS7 NULL pointer dereferences fix ([CVE-2015-0289])
548 * DoS via reachable assert in SSLv2 servers fix ([CVE-2015-0293])
549 * Empty CKE with client auth and DHE fix ([CVE-2015-1787])
550 * Handshake with unseeded PRNG fix ([CVE-2015-0285])
551 * Use After Free following d2i_ECPrivatekey error fix ([CVE-2015-0209])
552 * X509_to_X509_REQ NULL pointer deref fix ([CVE-2015-0288])
553 * Removed the export ciphers from the DEFAULT ciphers
564 * CMS support for RSA-PSS, RSA-OAEP, ECDH and X9.42 DH.
567 -------------
571 * OCSP Status Request extension unbounded memory growth ([CVE-2016-6304])
572 * SWEET32 Mitigation ([CVE-2016-2183])
573 * OOB write in MDC2_Update() ([CVE-2016-6303])
574 * Malformed SHA512 ticket DoS ([CVE-2016-6302])
575 * OOB write in BN_bn2dec() ([CVE-2016-2182])
576 * OOB read in TS_OBJ_print_bio() ([CVE-2016-2180])
577 * Pointer arithmetic undefined behaviour ([CVE-2016-2177])
578 * Constant time flag not preserved in DSA signing ([CVE-2016-2178])
579 * DTLS buffered message DoS ([CVE-2016-2179])
580 * DTLS replay protection DoS ([CVE-2016-2181])
581 * Certificate message OOB reads ([CVE-2016-6306])
585 * Prevent padding oracle in AES-NI CBC MAC check ([CVE-2016-2107])
586 * Fix EVP_EncodeUpdate overflow ([CVE-2016-2105])
587 * Fix EVP_EncryptUpdate overflow ([CVE-2016-2106])
588 * Prevent ASN.1 BIO excessive memory allocation ([CVE-2016-2109])
589 * EBCDIC overread ([CVE-2016-2176])
594 * Only remove the SSLv2 methods with the no-ssl2-method option.
598 * Disable weak ciphers in SSLv3 and up in default builds of OpenSSL.
599 * Disable SSLv2 default build, default negotiation and weak ciphers
600 ([CVE-2016-0800])
601 * Fix a double-free in DSA code ([CVE-2016-0705])
603 ([CVE-2016-0798])
605 ([CVE-2016-0797])
606 * Fix memory issues in BIO_*printf functions ([CVE-2016-0799])
607 * Fix side channel attack on modular exponentiation ([CVE-2016-0702])
612 * SSLv2 doesn't block disabled ciphers ([CVE-2015-3197])
616 * Certificate verify crash with missing PSS parameter ([CVE-2015-3194])
617 * X509_ATTRIBUTE memory leak ([CVE-2015-3195])
624 * Alternate chains certificate forgery ([CVE-2015-1793])
625 * Race condition handling PSK identify hint ([CVE-2015-3196])
633 * Malformed ECParameters causes infinite loop ([CVE-2015-1788])
634 * Exploitable out-of-bounds read in X509_cmp_time ([CVE-2015-1789])
635 * PKCS7 crash with missing EnvelopedContent ([CVE-2015-1790])
636 * CMS verify infinite loop with unknown hash function ([CVE-2015-1792])
637 * Race condition handling NewSessionTicket ([CVE-2015-1791])
641 * Segmentation fault in ASN1_TYPE_cmp fix ([CVE-2015-0286])
642 * ASN.1 structure reuse memory corruption fix ([CVE-2015-0287])
643 * PKCS7 NULL pointer dereferences fix ([CVE-2015-0289])
644 * DoS via reachable assert in SSLv2 servers fix ([CVE-2015-0293])
645 * Use After Free following d2i_ECPrivatekey error fix ([CVE-2015-0209])
646 * X509_to_X509_REQ NULL pointer deref fix ([CVE-2015-0288])
647 * Removed the export ciphers from the DEFAULT ciphers
655 * Fix for [CVE-2014-3571]
656 * Fix for [CVE-2015-0206]
657 * Fix for [CVE-2014-3569]
658 * Fix for [CVE-2014-3572]
659 * Fix for [CVE-2015-0204]
660 * Fix for [CVE-2015-0205]
661 * Fix for [CVE-2014-8275]
662 * Fix for [CVE-2014-3570]
666 * Fix for [CVE-2014-3513]
667 * Fix for [CVE-2014-3567]
668 * Mitigation for [CVE-2014-3566] (SSL protocol vulnerability)
669 * Fix for [CVE-2014-3568]
673 * Fix for [CVE-2014-3512]
674 * Fix for [CVE-2014-3511]
675 * Fix for [CVE-2014-3510]
676 * Fix for [CVE-2014-3507]
677 * Fix for [CVE-2014-3506]
678 * Fix for [CVE-2014-3505]
679 * Fix for [CVE-2014-3509]
680 * Fix for [CVE-2014-5139]
681 * Fix for [CVE-2014-3508]
685 * Fix for [CVE-2014-0224]
686 * Fix for [CVE-2014-0221]
687 * Fix for [CVE-2014-0198]
688 * Fix for [CVE-2014-0195]
689 * Fix for [CVE-2014-3470]
690 * Fix for [CVE-2010-5298]
694 * Fix for [CVE-2014-0160]
696 * Fix for [CVE-2014-0076]
701 * Fix for TLS record tampering bug ([CVE-2013-4353])
702 * Fix for TLS version checking bug ([CVE-2013-6449])
703 * Fix for DTLS retransmission bug ([CVE-2013-6450])
707 * Corrected fix for ([CVE-2013-0169])
713 * Fix OCSP bad key DoS attack ([CVE-2013-0166])
714 * Fix for SSL/TLS/DTLS CBC plaintext recovery attack ([CVE-2013-0169])
715 * Fix for TLS AESNI record handling flaw ([CVE-2012-2686])
719 * Fix TLS/DTLS record length checking bug ([CVE-2012-2333])
720 * Don't attempt to use non-FIPS composite ciphers in FIPS mode.
724 * Fix compilation error on non-x86 platforms.
725 * Make FIPS capable OpenSSL ciphers work in non-FIPS mode.
730 * Fix for ASN1 overflow bug ([CVE-2012-2110])
739 * RFC 5764 DTLS-SRTP negotiation.
748 -------------
752 * X509_ATTRIBUTE memory leak (([CVE-2015-3195]))
753 * Race condition handling PSK identify hint ([CVE-2015-3196])
757 * Malformed ECParameters causes infinite loop ([CVE-2015-1788])
758 * Exploitable out-of-bounds read in X509_cmp_time ([CVE-2015-1789])
759 * PKCS7 crash with missing EnvelopedContent ([CVE-2015-1790])
760 * CMS verify infinite loop with unknown hash function ([CVE-2015-1792])
761 * Race condition handling NewSessionTicket ([CVE-2015-1791])
765 * Segmentation fault in ASN1_TYPE_cmp fix ([CVE-2015-0286])
766 * ASN.1 structure reuse memory corruption fix ([CVE-2015-0287])
767 * PKCS7 NULL pointer dereferences fix ([CVE-2015-0289])
768 * DoS via reachable assert in SSLv2 servers fix ([CVE-2015-0293])
769 * Use After Free following d2i_ECPrivatekey error fix ([CVE-2015-0209])
770 * X509_to_X509_REQ NULL pointer deref fix ([CVE-2015-0288])
771 * Removed the export ciphers from the DEFAULT ciphers
779 * Fix for [CVE-2014-3571]
780 * Fix for [CVE-2015-0206]
781 * Fix for [CVE-2014-3569]
782 * Fix for [CVE-2014-3572]
783 * Fix for [CVE-2015-0204]
784 * Fix for [CVE-2015-0205]
785 * Fix for [CVE-2014-8275]
786 * Fix for [CVE-2014-3570]
790 * Fix for [CVE-2014-3513]
791 * Fix for [CVE-2014-3567]
792 * Mitigation for [CVE-2014-3566] (SSL protocol vulnerability)
793 * Fix for [CVE-2014-3568]
797 * Fix for [CVE-2014-3510]
798 * Fix for [CVE-2014-3507]
799 * Fix for [CVE-2014-3506]
800 * Fix for [CVE-2014-3505]
801 * Fix for [CVE-2014-3509]
802 * Fix for [CVE-2014-3508]
806 * EAP-FAST and other applications using tls_session_secret_cb
807 won't resume sessions. Fixed in 1.0.0n-dev
809 `<limits.h>` include. Fixed in 1.0.0n-dev
813 * Fix for [CVE-2014-0224]
814 * Fix for [CVE-2014-0221]
815 * Fix for [CVE-2014-0198]
816 * Fix for [CVE-2014-0195]
817 * Fix for [CVE-2014-3470]
818 * Fix for [CVE-2014-0076]
819 * Fix for [CVE-2010-5298]
823 * Fix for DTLS retransmission bug ([CVE-2013-6450])
827 * Fix for SSL/TLS/DTLS CBC plaintext recovery attack ([CVE-2013-0169])
828 * Fix OCSP bad key DoS attack ([CVE-2013-0166])
832 * Fix DTLS record length checking bug ([CVE-2012-2333])
836 * Fix for ASN1 overflow bug ([CVE-2012-2110])
840 * Fix for CMS/PKCS#7 MMA ([CVE-2012-0884])
841 * Corrected fix for ([CVE-2011-4619])
846 * Fix for DTLS DoS issue ([CVE-2012-0050])
850 * Fix for DTLS plaintext recovery attack ([CVE-2011-4108])
851 * Clear block padding bytes of SSL 3.0 records ([CVE-2011-4576])
852 * Only allow one SGC handshake restart for SSL/TLS ([CVE-2011-4619])
853 * Check parameters are not NULL in GOST ENGINE ([CVE-2012-0027])
854 * Check for malformed RFC3779 data ([CVE-2011-4577])
858 * Fix for CRL vulnerability issue ([CVE-2011-3207])
859 * Fix for ECDH crashes ([CVE-2011-3210])
866 * Fix for security issue ([CVE-2011-0014])
870 * Fix for security issue ([CVE-2010-4180])
871 * Fix for ([CVE-2010-4252])
874 * Corrected fix for security issue ([CVE-2010-3864]).
878 * Fix for security issue ([CVE-2010-3864]).
879 * Fix for ([CVE-2010-2939])
884 * Fix for security issue ([CVE-2010-1633]).
901 * SSL/TLS GOST ciphersuite support.
905 * ecdsa-with-SHA224/256/384/512 signature types.
906 * dsa-with-SHA224 and dsa-with-SHA256 signature types.
911 -------------
916 * Fix security issues [CVE-2010-0740] and [CVE-2010-0433].
932 * Temporary work around for [CVE-2009-3555]: disable renegotiation.
937 * Fix security issues [CVE-2009-0590], [CVE-2009-0591], [CVE-2009-0789]
941 * Fix security issue ([CVE-2008-5077])
942 * Merge FIPS 140-2 branch code.
974 * Introduce limits to prevent malicious key DoS ([CVE-2006-2940])
975 * Fix security issues [CVE-2006-2937], [CVE-2006-3737], [CVE-2006-4343]
980 * Fix Daniel Bleichenbacher forged signature attack, [CVE-2006-4339]
995 * Fix potential SSL 2.0 rollback ([CVE-2005-2969])
1007 * New ASN.1 mini-compiler that's usable through the OpenSSL
1019 * Changed the key-generation and primality testing "progress"
1029 * Added support for multi-valued AVAs in the OpenSSL
1033 * Make it possible to create self-signed certificates using
1034 'openssl ca -selfsign'.
1036 'openssl ca -create_serial'.
1045 * Changed the PKCS#7 library to support one-pass S/MIME
1049 'no-deprecated' argument to the config and Configure scripts.
1053 * New FIPS 180-2 algorithms (SHA-224, -256, -384 and -512).
1056 * Major overhaul of RC4 performance on Intel P4, IA-64 and
1060 argument form 'enable-xxx'.
1062 SHA-1.
1065 * Added support for the RSA-PSS encryption scheme
1070 * Added alternate pkg-config files.
1079 * Introduce limits to prevent malicious key DoS ([CVE-2006-2940])
1080 * Fix security issues [CVE-2006-2937], [CVE-2006-3737], [CVE-2006-4343]
1084 * Fix Daniel Bleichenbacher forged signature attack, [CVE-2006-4339]
1097 * Fix SSL 2.0 Rollback ([CVE-2005-2969])
1098 * Allow use of fixed-length exponent on DSA signing
1099 * Default fixed-window RSA, DSA, DH private-key operations
1125 * Security: Fix Kerberos ciphersuite SSL/TLS handshaking bug
1126 * Security: Fix null-pointer assignment in do_change_cipher_spec()
1134 * New -ignore_err option to OCSP utility.
1136 * SSL/TLS protocol fix for unrequested client certificates.
1140 * Security: counter the Klima-Pokorny-Rosa extension of
1144 * Support for new platforms: linux-ia64-ecc.
1156 * Configuration: the no-err option now works properly.
1157 * SSL/TLS: now handles manual certificate chain building.
1158 * SSL/TLS: certain session ID malfunctions corrected.
1172 * Support for new platforms: Windows CE, Tandem OSS, A/UX, AIX 64-bit,
1173 Linux x86_64, Linux 64-bit on Sparc v9
1177 * Support for pkg-config.
1186 to be available via EVP routines for asymmetric and symmetric ciphers.
1198 * SSL/TLS: allow optional cipher choice according to server's preference.
1199 * SSL/TLS: allow server to explicitly set new session ids.
1200 * SSL/TLS: support Kerberos cipher suites (RFC2712).
1202 * SSL/TLS: allow more precise control of renegotiations and sessions.
1203 * SSL/TLS: add callback to retrieve SSL/TLS messages.
1204 * SSL/TLS: support AES cipher suites (RFC3268).
1209 * SSL/TLS protocol fix for unrequested client certificates.
1213 * Security: counter the Klima-Pokorny-Rosa extension of
1226 * Better handling of SSL session caching.
1228 * Better handling of shared libraries in a mixed GNU/non-GNU environment.
1247 * Various SSL/TLS library bugfixes.
1251 * Various SSL/TLS library bugfixes.
1252 * Fix DH parameter generation for 'non-standard' generators.
1256 * Various SSL/TLS library bugfixes.
1262 MIPS Linux; shared library support for Irix, HP-UX.
1265 [in 0.9.6c-engine release].
1277 * Bug fix to make PRNG thread-safe.
1288 * Security fix: check the result of RSA-CRT to reduce the
1298 * Bug fixes in BIGNUM, SSL, PKCS#7, PKCS#12, X.509, CONF and
1307 * Add "-rand" option to openssl s_client and s_server.
1311 * Some documentation for BIO and SSL libraries.
1315 * New 'rsautl' application, low-level RSA utility.
1317 * Bugfix for SSL rollback padding check.
1322 distribution. See the file README-Engine.md.
1327 * Shared library support for HPUX and Solaris-gcc
1353 * TLS/SSL protocol bugfixes: Accept TLS 'client hello' in SSL 3.0
1356 * TLS/SSL code now "tolerates" MS SGC
1361 via a per-thread stack
1377 * New pipe-like BIO that allows using the SSL library when actual I/O
1384 * Added "openssl ca -revoke" option for revoking a certificate
1385 * Source cleanups: const correctness, type-safe stacks and ASN.1 SETs
1393 * Option to disable selected ciphers
1399 * "ALL" in cipher lists now means "everything except NULL ciphers"
1400 * Support for Triple-DES CBCM cipher
1402 * First support for new TLSv1 ciphers
1407 * Extended support for compression inside the SSL record layer
1421 * Initial support for compression inside the SSL record layer
1430 <!-- Links -->
1432 [CVE-2023-4807]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-4807
1433 [CVE-2023-3817]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-3817
1434 [CVE-2023-3446]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-3446
1435 [CVE-2023-2975]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-2975
1436 [CVE-2023-2650]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-2650
1437 [CVE-2023-0466]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-0466
1438 [CVE-2023-1255]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-1255
1439 [CVE-2022-2274]: https://www.openssl.org/news/vulnerabilities.html#CVE-2022-2274
1440 [CVE-2022-2097]: https://www.openssl.org/news/vulnerabilities.html#CVE-2022-2274
1441 [CVE-2020-1971]: https://www.openssl.org/news/vulnerabilities.html#CVE-2020-1971
1442 [CVE-2020-1967]: https://www.openssl.org/news/vulnerabilities.html#CVE-2020-1967
1443 [CVE-2019-1563]: https://www.openssl.org/news/vulnerabilities.html#CVE-2019-1563
1444 [CVE-2019-1559]: https://www.openssl.org/news/vulnerabilities.html#CVE-2019-1559
1445 [CVE-2019-1552]: https://www.openssl.org/news/vulnerabilities.html#CVE-2019-1552
1446 [CVE-2019-1551]: https://www.openssl.org/news/vulnerabilities.html#CVE-2019-1551
1447 [CVE-2019-1549]: https://www.openssl.org/news/vulnerabilities.html#CVE-2019-1549
1448 [CVE-2019-1547]: https://www.openssl.org/news/vulnerabilities.html#CVE-2019-1547
1449 [CVE-2019-1543]: https://www.openssl.org/news/vulnerabilities.html#CVE-2019-1543
1450 [CVE-2018-5407]: https://www.openssl.org/news/vulnerabilities.html#CVE-2018-5407
1451 [CVE-2018-0739]: https://www.openssl.org/news/vulnerabilities.html#CVE-2018-0739
1452 [CVE-2018-0737]: https://www.openssl.org/news/vulnerabilities.html#CVE-2018-0737
1453 [CVE-2018-0735]: https://www.openssl.org/news/vulnerabilities.html#CVE-2018-0735
1454 [CVE-2018-0734]: https://www.openssl.org/news/vulnerabilities.html#CVE-2018-0734
1455 [CVE-2018-0733]: https://www.openssl.org/news/vulnerabilities.html#CVE-2018-0733
1456 [CVE-2018-0732]: https://www.openssl.org/news/vulnerabilities.html#CVE-2018-0732
1457 [CVE-2017-3738]: https://www.openssl.org/news/vulnerabilities.html#CVE-2017-3738
1458 [CVE-2017-3737]: https://www.openssl.org/news/vulnerabilities.html#CVE-2017-3737
1459 [CVE-2017-3736]: https://www.openssl.org/news/vulnerabilities.html#CVE-2017-3736
1460 [CVE-2017-3735]: https://www.openssl.org/news/vulnerabilities.html#CVE-2017-3735
1461 [CVE-2017-3733]: https://www.openssl.org/news/vulnerabilities.html#CVE-2017-3733
1462 [CVE-2017-3732]: https://www.openssl.org/news/vulnerabilities.html#CVE-2017-3732
1463 [CVE-2017-3731]: https://www.openssl.org/news/vulnerabilities.html#CVE-2017-3731
1464 [CVE-2017-3730]: https://www.openssl.org/news/vulnerabilities.html#CVE-2017-3730
1465 [CVE-2016-7055]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-7055
1466 [CVE-2016-7054]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-7054
1467 [CVE-2016-7053]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-7053
1468 [CVE-2016-7052]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-7052
1469 [CVE-2016-6309]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-6309
1470 [CVE-2016-6308]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-6308
1471 [CVE-2016-6307]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-6307
1472 [CVE-2016-6306]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-6306
1473 [CVE-2016-6305]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-6305
1474 [CVE-2016-6304]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-6304
1475 [CVE-2016-6303]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-6303
1476 [CVE-2016-6302]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-6302
1477 [CVE-2016-2183]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2183
1478 [CVE-2016-2182]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2182
1479 [CVE-2016-2181]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2181
1480 [CVE-2016-2180]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2180
1481 [CVE-2016-2179]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2179
1482 [CVE-2016-2178]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2178
1483 [CVE-2016-2177]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2177
1484 [CVE-2016-2176]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2176
1485 [CVE-2016-2109]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2109
1486 [CVE-2016-2107]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2107
1487 [CVE-2016-2106]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2106
1488 [CVE-2016-2105]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2105
1489 [CVE-2016-0800]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-0800
1490 [CVE-2016-0799]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-0799
1491 [CVE-2016-0798]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-0798
1492 [CVE-2016-0797]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-0797
1493 [CVE-2016-0705]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-0705
1494 [CVE-2016-0702]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-0702
1495 [CVE-2016-0701]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-0701
1496 [CVE-2015-3197]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-3197
1497 [CVE-2015-3196]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-3196
1498 [CVE-2015-3195]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-3195
1499 [CVE-2015-3194]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-3194
1500 [CVE-2015-3193]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-3193
1501 [CVE-2015-1793]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-1793
1502 [CVE-2015-1792]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-1792
1503 [CVE-2015-1791]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-1791
1504 [CVE-2015-1790]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-1790
1505 [CVE-2015-1789]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-1789
1506 [CVE-2015-1788]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-1788
1507 [CVE-2015-1787]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-1787
1508 [CVE-2015-0293]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0293
1509 [CVE-2015-0291]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0291
1510 [CVE-2015-0290]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0290
1511 [CVE-2015-0289]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0289
1512 [CVE-2015-0288]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0288
1513 [CVE-2015-0287]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0287
1514 [CVE-2015-0286]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0286
1515 [CVE-2015-0285]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0285
1516 [CVE-2015-0209]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0209
1517 [CVE-2015-0208]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0208
1518 [CVE-2015-0207]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0207
1519 [CVE-2015-0206]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0206
1520 [CVE-2015-0205]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0205
1521 [CVE-2015-0204]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0204
1522 [CVE-2014-8275]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-8275
1523 [CVE-2014-5139]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-5139
1524 [CVE-2014-3572]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3572
1525 [CVE-2014-3571]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3571
1526 [CVE-2014-3570]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3570
1527 [CVE-2014-3569]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3569
1528 [CVE-2014-3568]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3568
1529 [CVE-2014-3567]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3567
1530 [CVE-2014-3566]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3566
1531 [CVE-2014-3513]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3513
1532 [CVE-2014-3512]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3512
1533 [CVE-2014-3511]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3511
1534 [CVE-2014-3510]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3510
1535 [CVE-2014-3509]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3509
1536 [CVE-2014-3508]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3508
1537 [CVE-2014-3507]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3507
1538 [CVE-2014-3506]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3506
1539 [CVE-2014-3505]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3505
1540 [CVE-2014-3470]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3470
1541 [CVE-2014-0224]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-0224
1542 [CVE-2014-0221]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-0221
1543 [CVE-2014-0198]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-0198
1544 [CVE-2014-0195]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-0195
1545 [CVE-2014-0160]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-0160
1546 [CVE-2014-0076]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-0076
1547 [CVE-2013-6450]: https://www.openssl.org/news/vulnerabilities.html#CVE-2013-6450
1548 [CVE-2013-6449]: https://www.openssl.org/news/vulnerabilities.html#CVE-2013-6449
1549 [CVE-2013-4353]: https://www.openssl.org/news/vulnerabilities.html#CVE-2013-4353
1550 [CVE-2013-0169]: https://www.openssl.org/news/vulnerabilities.html#CVE-2013-0169
1551 [CVE-2013-0166]: https://www.openssl.org/news/vulnerabilities.html#CVE-2013-0166
1552 [CVE-2012-2686]: https://www.openssl.org/news/vulnerabilities.html#CVE-2012-2686
1553 [CVE-2012-2333]: https://www.openssl.org/news/vulnerabilities.html#CVE-2012-2333
1554 [CVE-2012-2110]: https://www.openssl.org/news/vulnerabilities.html#CVE-2012-2110
1555 [CVE-2012-0884]: https://www.openssl.org/news/vulnerabilities.html#CVE-2012-0884
1556 [CVE-2012-0050]: https://www.openssl.org/news/vulnerabilities.html#CVE-2012-0050
1557 [CVE-2012-0027]: https://www.openssl.org/news/vulnerabilities.html#CVE-2012-0027
1558 [CVE-2011-4619]: https://www.openssl.org/news/vulnerabilities.html#CVE-2011-4619
1559 [CVE-2011-4577]: https://www.openssl.org/news/vulnerabilities.html#CVE-2011-4577
1560 [CVE-2011-4576]: https://www.openssl.org/news/vulnerabilities.html#CVE-2011-4576
1561 [CVE-2011-4108]: https://www.openssl.org/news/vulnerabilities.html#CVE-2011-4108
1562 [CVE-2011-3210]: https://www.openssl.org/news/vulnerabilities.html#CVE-2011-3210
1563 [CVE-2011-3207]: https://www.openssl.org/news/vulnerabilities.html#CVE-2011-3207
1564 [CVE-2011-0014]: https://www.openssl.org/news/vulnerabilities.html#CVE-2011-0014
1565 [CVE-2010-5298]: https://www.openssl.org/news/vulnerabilities.html#CVE-2010-5298
1566 [CVE-2010-4252]: https://www.openssl.org/news/vulnerabilities.html#CVE-2010-4252
1567 [CVE-2010-4180]: https://www.openssl.org/news/vulnerabilities.html#CVE-2010-4180
1568 [CVE-2010-3864]: https://www.openssl.org/news/vulnerabilities.html#CVE-2010-3864
1569 [CVE-2010-2939]: https://www.openssl.org/news/vulnerabilities.html#CVE-2010-2939
1570 [CVE-2010-1633]: https://www.openssl.org/news/vulnerabilities.html#CVE-2010-1633
1571 [CVE-2010-0740]: https://www.openssl.org/news/vulnerabilities.html#CVE-2010-0740
1572 [CVE-2010-0433]: https://www.openssl.org/news/vulnerabilities.html#CVE-2010-0433
1573 [CVE-2009-3555]: https://www.openssl.org/news/vulnerabilities.html#CVE-2009-3555
1574 [CVE-2009-0789]: https://www.openssl.org/news/vulnerabilities.html#CVE-2009-0789
1575 [CVE-2009-0591]: https://www.openssl.org/news/vulnerabilities.html#CVE-2009-0591
1576 [CVE-2009-0590]: https://www.openssl.org/news/vulnerabilities.html#CVE-2009-0590
1577 [CVE-2008-5077]: https://www.openssl.org/news/vulnerabilities.html#CVE-2008-5077
1578 [CVE-2006-4343]: https://www.openssl.org/news/vulnerabilities.html#CVE-2006-4343
1579 [CVE-2006-4339]: https://www.openssl.org/news/vulnerabilities.html#CVE-2006-4339
1580 [CVE-2006-3737]: https://www.openssl.org/news/vulnerabilities.html#CVE-2006-3737
1581 [CVE-2006-2940]: https://www.openssl.org/news/vulnerabilities.html#CVE-2006-2940
1582 [CVE-2006-2937]: https://www.openssl.org/news/vulnerabilities.html#CVE-2006-2937
1583 [CVE-2005-2969]: https://www.openssl.org/news/vulnerabilities.html#CVE-2005-2969