From d20799d2d670ffccb73402cd07836a18aae8a9c0 Mon Sep 17 00:00:00 2001 From: Janne Johansson Date: Tue, 19 Feb 2019 13:57:14 +0200 Subject: [PATCH] Changelog update. --- release_notes-4-0-1-open.html => release_notes-4-0-2-open.html | 2 ++ 1 file changed, 2 insertions(+) rename release_notes-4-0-1-open.html => release_notes-4-0-2-open.html (94%) diff --git a/release_notes-4-0-1-open.html b/release_notes-4-0-2-open.html similarity index 94% rename from release_notes-4-0-1-open.html rename to release_notes-4-0-2-open.html index 08ce9e3..b705363 100644 --- a/release_notes-4-0-1-open.html +++ b/release_notes-4-0-2-open.html @@ -9,6 +9,8 @@

MatrixSSL 4.x changelog

+

Changes between 4.0.1 and 4.0.2 [February 2019]

+

This version fixes a critical vulnerability in RSA signature verification. A maliciously crafted certificate can be used to trigger a stack buffer overflow, allowing potential remote code execution attacks. The vulnerability only affects version 4.0.1 and the standard Matrix Crypto provider. Other providers, such as the FIPS crypto provider, are not affected by the bug. Thanks to Tavis Ormandy for reporting this.

Changes between 4.0.0 and 4.0.1 [November 2018]

This version improves the security of RSA PKCS #1.5 signature verification and adds better support for run-time security configuration.