id	summary	reporter	owner	description	type	status	priority	milestone	component	version	severity	resolution	keywords	cc
6596	openssl-1.0.2c	bdubbs@…	Fernando de Oliveira	"New micro version

Now openssl-1.0.2c.

[https://openssl.org/source/openssl-1.0.2c.tar.gz]

[https://openssl.org/source/openssl-1.0.2c.tar.gz.md5]

[https://openssl.org/source/openssl-1.0.2c.tar.gz.asc]

[https://openssl.org/news/openssl-1.0.2-notes.html]

or

[https://raw.githubusercontent.com/openssl/openssl/OpenSSL_1_0_2-stable/CHANGES]

(Latter is more detailed and more recent.)

{{{
 Major changes between OpenSSL 1.0.2b and OpenSSL 1.0.2c [12 Jun 2015]

    Fix HMAC ABI incompatibility 

Major changes between OpenSSL 1.0.2a and OpenSSL 1.0.2b [11 Jun 2015]

    Malformed ECParameters causes infinite loop (CVE-2015-1788)
    Exploitable out-of-bounds read in X509_cmp_time (CVE-2015-1789)
    PKCS7 crash with missing EnvelopedContent (CVE-2015-1790)
    CMS verify infinite loop with unknown hash function (CVE-2015-1792)
    Race condition handling NewSessionTicket (CVE-2015-1791)
}}}

[https://openssl.org/news/secadv_20150611.txt]

{{{
OpenSSL Security Advisory [11 Jun 2015]
=======================================

DHE man-in-the-middle protection (Logjam)
====================================================================

A vulnerability in the TLS protocol allows a man-in-the-middle
attacker to downgrade vulnerable TLS connections using ephemeral
Diffie-Hellman key exchange to 512-bit export-grade cryptography. This
vulnerability is known as Logjam (CVE-2015-4000).

OpenSSL has added protection for TLS clients by rejecting handshakes
with DH parameters shorter than 768 bits. This limit will be increased
to 1024 bits in a future release.

OpenSSL 1.0.2 users should upgrade to 1.0.2b
OpenSSL 1.0.1 users should upgrade to 1.0.1n

Fixes for this issue were developed by Emilia Käsper and Kurt Roeckx
of the OpenSSL development team.

Malformed ECParameters causes infinite loop (CVE-2015-1788)
===========================================================

...

Exploitable out-of-bounds read in X509_cmp_time (CVE-2015-1789)
===============================================================

...

PKCS7 crash with missing EnvelopedContent (CVE-2015-1790)
=========================================================

...

CMS verify infinite loop with unknown hash function (CVE-2015-1792)
===================================================================

...

Race condition handling NewSessionTicket (CVE-2015-1791)
========================================================

...

Invalid free in DTLS (CVE-2014-8176)
====================================

...

}}}"	enhancement	closed	high	7.8	BOOK	SVN	medium	fixed