Browse code
Version 2.1_rc21
git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@5152 e7ae566f-a301-0410-adde-c780ea21d3b5
james authored on 2009/11/12 18:30:45Showing 3 changed files
| ... | ... |
@@ -1,6 +1,22 @@ |
| 1 | 1 |
OpenVPN Change Log |
| 2 | 2 |
Copyright (C) 2002-2009 OpenVPN Technologies, Inc. <sales@openvpn.net> |
| 3 | 3 |
|
| 4 |
+2009.11.12 -- Version 2.1_rc21 |
|
| 5 |
+ |
|
| 6 |
+* Rebuilt OpenVPN Windows installer with OpenSSL 0.9.8l to address |
|
| 7 |
+ CVE-2009-3555. Note that OpenVPN has never relied on the session |
|
| 8 |
+ renegotiation capabilities that are built into the SSL/TLS protocol, |
|
| 9 |
+ therefore the fix in OpenSSL 0.9.8l (disable SSL/TLS renegotiation |
|
| 10 |
+ completely) will not adversely affect OpenVPN mid-session SSL/TLS |
|
| 11 |
+ renegotation or any other OpenVPN capabilities. |
|
| 12 |
+ |
|
| 13 |
+* Added additional session renegotiation hardening. OpenVPN has always |
|
| 14 |
+ required that mid-session renegotiations build up a new SSL/TLS |
|
| 15 |
+ session from scratch. While the client certificate common name is |
|
| 16 |
+ already locked against changes in mid-session TLS renegotiations, we |
|
| 17 |
+ now extend this locking to the auth-user-pass username as well as all |
|
| 18 |
+ certificate content in the full client certificate chain. |
|
| 19 |
+ |
|
| 4 | 20 |
2009.10.01 -- Version 2.1_rc20 |
| 5 | 21 |
|
| 6 | 22 |
* Fixed a bug introduced in 2.1_rc17 (svn r4436) where using the |
| ... | ... |
@@ -22,7 +22,7 @@ |
| 22 | 22 |
;!define OPENVPN_XGUI_DIR "../ovpnxml" |
| 23 | 23 |
|
| 24 | 24 |
# Prebuilt libraries. DMALLOC is optional. |
| 25 |
-!define OPENSSL_DIR "../openssl-0.9.8k" |
|
| 25 |
+!define OPENSSL_DIR "../openssl-0.9.8l" |
|
| 26 | 26 |
!define LZO_DIR "../lzo-2.02" |
| 27 | 27 |
!define PKCS11_HELPER_DIR "../pkcs11-helper" |
| 28 | 28 |
;!define DMALLOC_DIR "../dmalloc-5.4.2" |