[el5_latest] openssl-perl-0.9.8e-40.0.1.el5_11.i386

Name:	openssl-perl
Version:	0.9.8e
Release:	40.0.1.el5_11
Architecture:	i386
Group:	Applications/Internet
Size:	13130
License:	BSDish
RPM:	openssl-perl-0.9.8e-40.0.1.el5_11.i386.rpm
Source RPM:	openssl-0.9.8e-40.0.1.el5_11.src.rpm
Build Date:	Tue May 31 2016
Build Host:	x86-ol6-builder-02.us.oracle.com
Vendor:	Oracle America
URL:	http://www.openssl.org/
Summary:	Perl scripts provided with OpenSSL
Description:	OpenSSL is a toolkit for supporting cryptography. The openssl-perl package provides Perl scripts for converting certificates and keys from other formats to the formats used by the OpenSSL toolkit.

Changelog (Show File list) (Show related packages)

Tue May 31 2016 Jacob Wang <jacob.wang@oracle.com> - 0.9.8e-40.0.1

- To disable SSLv2 client connections create the file
  /etc/sysconfig/openssl-ssl-client-kill-sslv2 (John Haxby) [orabug 21673934]
- Backport openssl 08-Jan-2015 security fixes (John Haxby) [orabug 20409893]
- fix CVE-2014-3570 - Bignum squaring may produce incorrect results
- fix CVE-2014-3571 - DTLS segmentation fault in dtls1_get_record
- fix CVE-2014-3572 - ECDHE silently downgrades to ECDH [Client]

Wed May 18 2016 Tomas Mraz <tmraz@redhat.com> 0.9.8e-40

- fix CVE-2016-2108 - memory corruption in ASN.1 encoder

Fri Feb 26 2016 Tomas Mraz <tmraz@redhat.com> 0.9.8e-39

- fix CVE-2016-0797 - heap corruption in BN_hex2bn and BN_dec2bn

Fri Feb 19 2016 Tomas Mraz <tmraz@redhat.com> 0.9.8e-38

- fix CVE-2015-3197 - SSLv2 ciphersuite enforcement
- disable SSLv2 in the generic TLS method (can be reenabled
  by setting environment variable OPENSSL_ENABLE_SSL2)

Sat Dec 05 2015 Tomas Mraz <tmraz@redhat.com> 0.9.8e-37
```
- fix CVE-2015-3195 - X509_ATTRIBUTE memory leak
```

Fri Jun 26 2015 Tomas Mraz <tmraz@redhat.com> 0.9.8e-36

- also change the default DH parameters in s_server to 1024 bits

Wed Jun 24 2015 Tomas Mraz <tmraz@redhat.com> 0.9.8e-35

- fix CVE-2015-1789 - out-of-bounds read in X509_cmp_time
- fix CVE-2015-1790 - PKCS7 crash with missing EncryptedContent
- fix CVE-2015-4000 - prevent the logjam attack on client - restrict
  the DH key size to at least 768 bits (limit will be increased in future)

Tue Apr 28 2015 Kai Engert <kaie@redhat.com> 0.9.8e-34

- Rebase ca-bundle.crt to the upstream version 2.4 with legacy
  modifications. For compatibility reasons, several CA certificates with
  RSA sizes of 1024 bits are still included.
- Add a patch to the source RPM that documents the changes from the
  upstream version.

Fri Apr 03 2015 Tomas Mraz <tmraz@redhat.com> 0.9.8e-33

- fix CVE-2014-8275 (without introduction of CVE-2015-0286) - various
  certificate fingerprint issues
- fix CVE-2015-0204 - remove support for RSA ephemeral keys for non-export
  ciphersuites and on server
- fix CVE-2015-0287 - ASN.1 structure reuse decoding memory corruption
- fix CVE-2015-0288 - X509_to_X509_REQ NULL pointer dereference
- fix CVE-2015-0289 - NULL dereference decoding invalid PKCS#7 data
- fix CVE-2015-0292 - integer underflow in base64 decoder
- fix CVE-2015-0293 - triggerable assert in SSLv2 server

Thu Dec 18 2014 Tomas Mraz <tmraz@redhat.com> 0.9.8e-32
```
- properly lock X509_STORE accesses (#1168938)
```

Thu Oct 16 2014 Tomas Mraz <tmraz@redhat.com> 0.9.8e-31

- add support for fallback SCSV to partially mitigate CVE-2014-3566
  (padding attack on SSL3)

Sat Aug 09 2014 Tomas Mraz <tmraz@redhat.com> 0.9.8e-30

- fix CVE-2014-0221 - recursion in DTLS code leading to DoS
- fix CVE-2014-3505 - doublefree in DTLS packet processing
- fix CVE-2014-3506 - avoid memory exhaustion in DTLS
- fix CVE-2014-3508 - fix OID handling to avoid information leak
- fix CVE-2014-3510 - fix DoS in anonymous (EC)DH handling in DTLS

Tue Jun 03 2014 Tomas Mraz <tmraz@redhat.com> 0.9.8e-29
```
- fix for CVE-2014-0224 - SSL/TLS MITM vulnerability
```

Wed Jan 29 2014 Tomas Mraz <tmraz@redhat.com> 0.9.8e-28

- replace expired GlobalSign Root CA certificate in ca-bundle.crt

Tue Feb 26 2013 Tomas Mraz <tmraz@redhat.com> 0.9.8e-27

- fix for CVE-2013-0169 - SSL/TLS CBC timing attack (#907589)
- fix for CVE-2013-0166 - DoS in OCSP signatures checking (#908052)
- enable compression only if explicitly asked for or OPENSSL_DEFAULT_ZLIB
  environment variable is set (fixes CVE-2012-4929 #857051)
- use __secure_getenv() everywhere instead of getenv() (#839735)

Wed May 16 2012 Tomas Mraz <tmraz@redhat.com> 0.9.8e-26

- fix for CVE-2012-2333 - improper checking for record length in DTLS (#820686)

Tue Apr 24 2012 Tomas Mraz <tmraz@redhat.com> 0.9.8e-25

- fix for CVE-2012-2110 - memory corruption in asn1_d2i_read_bio() (#814185)

Tue Mar 20 2012 Tomas Mraz <tmraz@redhat.com> 0.9.8e-23

- fix problem with the SGC restart patch that might terminate handshake
  incorrectly
- fix for CVE-2012-0884 - MMA weakness in CMS and PKCS#7 code (#802725)
- fix for CVE-2012-1165 - NULL read dereference on bad MIME headers (#802489)

Thu Jan 19 2012 Tomas Mraz <tmraz@redhat.com> 0.9.8e-22

- fix for CVE-2011-4108 & CVE-2012-0050 - DTLS plaintext recovery
  vulnerability and additional DTLS fixes (#771770)
- fix for CVE-2011-4109 - double free in policy checks (#771771)
- fix for CVE-2011-4576 - uninitialized SSL 3.0 padding (#771775)
- fix for CVE-2011-4619 - SGC restart DoS attack (#771780)

Wed Oct 19 2011 Tomas Mraz <tmraz@redhat.com> 0.9.8e-21

- add known answer test for SHA2 algorithms (#740866)
- make default private key length in certificate Makefile 2048 bits
  (can be changed with PRIVATE_KEY_BITS setting) (#745410)
- fix incorrect return value in parse_yesno() (#726593)
- added DigiCert CA certificates to ca-bundle (#735819)
- added a new section about error states to README.FIPS (#628976)

Thu May 05 2011 Tomas Mraz <tmraz@redhat.com> 0.9.8e-20

- add missing DH_check_pub_key() call when DH key is computed (#698175)

Tue Apr 05 2011 Tomas Mraz <tmraz@redhat.com> 0.9.8e-19

- presort list of ciphers available in SSL (#688901)
- accept connection in s_server even if getaddrinfo() fails (#561260)
- point to openssl dgst for list of supported digests (#608639)
- fix handling of future TLS versions (#599112)
- added VeriSign Class 3 Public Primary Certification Authority - G5
  and StartCom Certification Authority certs to ca-bundle (#675671, #617856)
- upstream fixes for the CHIL engine (#622003, #671484)

Thu Mar 10 2011 Tomas Mraz <tmraz@redhat.com> 0.9.8e-18
```
- add SHA-2 hashes in SSL_library_init() (#676384)
```

Wed Dec 08 2010 Tomas Mraz <tmraz@redhat.com> 0.9.8e-17

- fix CVE-2010-4180 - completely disable code for
  SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG (#659462)

Sat Mar 13 2010 Tomas Mraz <tmraz@redhat.com> 0.9.8e-16

- fix CVE-2009-3245 - add missing bn_wexpand return checks (#570924)

Fri Mar 05 2010 Tomas Mraz <tmraz@redhat.com> 0.9.8e-15

- fix CVE-2010-0433 - do not pass NULL princ to krb5_kt_get_entry which
  in the RHEL-5 and newer versions will crash in such case (#569774)

Fri Feb 19 2010 Tomas Mraz <tmraz@redhat.com> 0.9.8e-14

- fix CVE-2009-3555 - support the safe renegotiation extension and
  do not allow legacy renegotiation on the server by default (#533125)

Fri Jan 15 2010 Tomas Mraz <tmraz@redhat.com> 0.9.8e-13

- fix CVE-2009-2409 - drop MD2 algorithm from EVP tables (#510197)
- fix CVE-2009-4355 - do not leak memory when CRYPTO_cleanup_all_ex_data()
  is called prematurely by application (#546707)

Tue Jun 30 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8e-12

- abort if selftests failed and random number generator is polled
- mention EVP_aes and EVP_sha2xx routines in the manpages
- add README.FIPS

Fri May 22 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8e-10

- fix CVE-2009-1386 CVE-2009-1387 (DTLS DoS problems)
  (#503685, #503688)

Fri May 22 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8e-9

- fix CVE-2009-1377 CVE-2009-1378 CVE-2009-1379
  (DTLS DoS problems) (#501253, #501254, #501572)

Thu Apr 16 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8e-8

- support multiple CRLs with same subject in a store (#457134)
- fix CVE-2009-0590 - reject incorrectly encoded ASN.1 strings (#492304)
- seed FIPS rng directly from kernel random device
- do not require fipscheck to build the package (#475798)
- call pairwise key tests in FIPS mode only (#479817)
- do not crash when parsing bad mime data (#472440)

Wed Dec 17 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8e-7

- fix CVE-2008-5077 - incorrect checks for malformed signatures (#476671)

Sat Nov 01 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8e-6
```
- allow lookup of algorithms in engine
```

Sat Oct 25 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8e-5

- implement the integrity checking inside libcrypto so OpenSSL
  can be used in FIPS mode by the fipscheck library

Fri Oct 10 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8e-4

- FIPS mode kernel flag is /proc/sys/crypto/fips_enabled

Thu Sep 11 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8e-3
```
- disable strict aliasing
```

Wed Sep 10 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8e-2

- more changes for FIPS validation (#444800)
- correctly initialize default CA paths (#450987)
- allow disabling zlib support through environment (#442624)

Wed Jul 16 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8e-1

- rebase to version undergoing FIPS validation (#455634)

Wed Jan 16 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8b-10

- compile with -march=z900 on s390 for performance improvements (#250818)
- make ssl session ID matching strict (#233599)

Tue Oct 09 2007 Tomas Mraz <tmraz@redhat.com> 0.9.8b-9

- fix CVE-2007-3108 - side channel attack on private keys (#250581)
- fix CVE-2007-5135 - off-by-one in SSL_get_shared_ciphers (#309881)
- fix CVE-2007-4995 - out of order DTLS fragments buffer overflow (#321221)

Fri Dec 01 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-8.3

- the previous change still didn't make X509_NAME_cmp transitive

Fri Nov 24 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-8.2

- make X509_NAME_cmp transitive otherwise certificate lookup
  is broken (#216050)

Sat Nov 04 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-8.1

- aliasing bug in engine loading, patch by IBM (#213216)

Tue Oct 03 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-8
```
- CVE-2006-2940 fix was incorrect (#208744)
```

Tue Sep 26 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-7

- fix CVE-2006-2937 - mishandled error on ASN.1 parsing (#207276)
- fix CVE-2006-2940 - parasitic public keys DoS (#207274)
- fix CVE-2006-3738 - buffer overflow in SSL_get_shared_ciphers (#206940)
- fix CVE-2006-4343 - sslv2 client DoS (#206940)

Wed Sep 06 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-6

- fix CVE-2006-4339 - prevent attack on PKCS#1 v1.5 signatures (#205180)

Thu Aug 03 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8b-5

- set buffering to none on stdio/stdout FILE when bufsize is set (#200580)
  patch by IBM

Sat Jul 29 2006 Alexandre Oliva <aoliva@redhat.com> - 0.9.8b-4.1
```
- rebuild with new binutils (#200330)
```

Sat Jul 22 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8b-4

- add a temporary workaround for sha512 test failure on s390 (#199604)

Fri Jul 21 2006 Tomas Mraz <tmraz@redhat.com>

- add ipv6 support to s_client and s_server (by Jan Pazdziora) (#198737)
- add patches for BN threadsafety, AES cache collision attack hazard fix and
  pkcs7 code memleak fix from upstream CVS

Thu Jul 13 2006 Jesse Keating <jkeating@redhat.com> - 0.9.8b-3.1
```
- rebuild
```
Thu Jun 22 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8b-3
```
- dropped libica and ica engine from build
```

Thu Jun 22 2006 Joe Orton <jorton@redhat.com>

- update to new CA bundle from mozilla.org; adds CA certificates
  from netlock.hu and startcom.org

Tue Jun 06 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8b-2

- fixed a few rpmlint warnings
- better fix for #173399 from upstream
- upstream fix for pkcs12

Fri May 12 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8b-1

- upgrade to new version, stays ABI compatible
- there is no more linux/config.h (it was empty anyway)

Wed Apr 05 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8a-6

- fix stale open handles in libica (#177155)
- fix build if 'rand' or 'passwd' in buildroot path (#178782)
- initialize VIA Padlock engine (#186857)

Sat Feb 11 2006 Jesse Keating <jkeating@redhat.com> - 0.9.8a-5.2
```
- bump again for double-long bug on ppc(64)
```
Wed Feb 08 2006 Jesse Keating <jkeating@redhat.com> - 0.9.8a-5.1
```
- rebuilt for new gcc4.1 snapshot and glibc changes
```

Fri Dec 16 2005 Tomas Mraz <tmraz@redhat.com> 0.9.8a-5

- don't include SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
  in SSL_OP_ALL (#175779)

Sat Dec 10 2005 Jesse Keating <jkeating@redhat.com>
```
- rebuilt
```

Wed Nov 30 2005 Tomas Mraz <tmraz@redhat.com> 0.9.8a-4

- fix build (-lcrypto was erroneusly dropped) of the updated libica
- updated ICA engine to 1.3.6-rc3

Wed Nov 23 2005 Tomas Mraz <tmraz@redhat.com> 0.9.8a-3

- disable builtin compression methods for now until they work
  properly (#173399)

Thu Nov 17 2005 Tomas Mraz <tmraz@redhat.com> 0.9.8a-2
```
- don't set -rpath for openssl binary
```
Wed Nov 09 2005 Tomas Mraz <tmraz@redhat.com> 0.9.8a-1
```
- new upstream version
- patches partially renumbered
```

Sat Oct 22 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-11

- updated IBM ICA engine library and patch to latest upstream version

Thu Oct 13 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-10

- fix CAN-2005-2969 - remove SSL_OP_MSIE_SSLV2_RSA_PADDING which
  disables the countermeasure against man in the middle attack in SSLv2
  (#169863)
- use sha1 as default for CA and cert requests - CAN-2005-2946 (#169803)

Wed Aug 24 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-9

- add *.so.soversion as symlinks in /lib (#165264)
- remove unpackaged symlinks (#159595)
- fixes from upstream (constant time fixes for DSA,
  bn assembler div on ppc arch, initialize memory on realloc)

Fri Aug 12 2005 Phil Knirsch <pknirsch@redhat.com> 0.9.7f-8
```
- Updated ICA engine IBM patch to latest upstream version.
```

Fri May 20 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-7

- fix CAN-2005-0109 - use constant time/memory access mod_exp
  so bits of private key aren't leaked by cache eviction (#157631)
- a few more fixes from upstream 0.9.7g

Thu Apr 28 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-6

- use poll instead of select in rand (#128285)
- fix Makefile.certificate to point to /etc/pki/tls
- change the default string mask in ASN1 to PrintableString+UTF8String

Tue Apr 26 2005 Joe Orton <jorton@redhat.com> 0.9.7f-5
```
- update to revision 1.37 of Mozilla CA bundle
```

Fri Apr 22 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-4

- move certificates to _sysconfdir/pki/tls (#143392)
- move CA directories to _sysconfdir/pki/CA
- patch the CA script and the default config so it points to the
  CA directories

Sat Apr 02 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-3

- uninitialized variable mustn't be used as input in inline
  assembly
- reenable the x86_64 assembly again

Fri Apr 01 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-2

- add back RC4_CHAR on ia64 and x86_64 so the ABI isn't broken
- disable broken bignum assembly on x86_64

Thu Mar 31 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-1

- reenable optimizations on ppc64 and assembly code on ia64
- upgrade to new upstream version (no soname bump needed)
- disable thread test - it was testing the backport of the
  RSA blinding - no longer needed
- added support for changing serial number to 
  Makefile.certificate (#151188)
- make ca-bundle.crt a config file (#118903)

Wed Mar 02 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7e-3
```
- libcrypto shouldn't depend on libkrb5 (#135961)
```
Tue Mar 01 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7e-2
```
- rebuild
```

Tue Mar 01 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7e-1

- new upstream source, updated patches
- added patch so we are hopefully ABI compatible with upcoming
  0.9.7f

Fri Feb 11 2005 Tomas Mraz <tmraz@redhat.com>

- Support UTF-8 charset in the Makefile.certificate (#134944)
- Added cmp to BuildPrereq

Fri Jan 28 2005 Joe Orton <jorton@redhat.com> 0.9.7a-46

- generate new ca-bundle.crt from Mozilla certdata.txt (revision 1.32)

Fri Dec 24 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-45

- Fixed and updated libica-1.3.4-urandom.patch patch (#122967)

Sat Nov 20 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-44
```
- rebuild
```
Sat Nov 20 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-43
```
- rebuild
```
Sat Nov 20 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-42
```
- rebuild
```

Sat Nov 20 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-41

- remove der_chop, as upstream cvs has done (CAN-2004-0975, #140040)

Wed Oct 06 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-40
```
- Include latest libica version with important bugfixes
```
Wed Jun 16 2004 Elliot Lee <sopwith@redhat.com>
```
- rebuilt
```
Tue Jun 15 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-38
```
- Updated ICA engine IBM patch to latest upstream version.
```

Tue Jun 08 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-37

- build for linux-alpha-gcc instead of alpha-gcc on alpha (Jeff Garzik)

Wed May 26 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-36

- handle %{_arch}=i486/i586/i686/athlon cases in the intermediate
  header (#124303)

Fri Mar 26 2004 Joe Orton <jorton@redhat.com> 0.9.7a-35
```
- add security fixes for CAN-2004-0079, CAN-2004-0112
```
Wed Mar 17 2004 Phil Knirsch <pknirsch@redhat.com>
```
- Fixed libica filespec.
```

Thu Mar 11 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-34

- ppc/ppc64 define __powerpc__/__powerpc64__, not __ppc__/__ppc64__, fix
  the intermediate header

Thu Mar 11 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-33

- add an intermediate <openssl/opensslconf.h> which points to the right
  arch-specific opensslconf.h on multilib arches

Wed Mar 03 2004 Elliot Lee <sopwith@redhat.com>
```
- rebuilt
```
Fri Feb 27 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-32
```
- Updated libica to latest upstream version 1.3.5.
```

Wed Feb 18 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-31

- Update ICA crypto engine patch from IBM to latest version.

Sat Feb 14 2004 Elliot Lee <sopwith@redhat.com>
```
- rebuilt
```
Sat Feb 14 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-29
```
- rebuilt
```
Thu Feb 12 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-28
```
- Fixed libica build.
```

Thu Feb 05 2004 Nalin Dahyabhai <nalin@redhat.com>

- add "-ldl" to link flags added for Linux-on-ARM (#99313)

Thu Feb 05 2004 Joe Orton <jorton@redhat.com> 0.9.7a-27

- updated ca-bundle.crt: removed expired GeoTrust roots, added
  freessl.com root, removed trustcenter.de Class 0 root

Mon Dec 01 2003 Tim Waugh <twaugh@redhat.com> 0.9.7a-26
```
- Fix link line for libssl (bug #111154).
```

Sat Oct 25 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-25

- add dependency on zlib-devel for the -devel package, which depends on zlib
  symbols because we enable zlib for libssl (#102962)

Sat Oct 25 2003 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-24

- Use /dev/urandom instead of PRNG for libica.
- Apply libica-1.3.5 fix for /dev/urandom in icalinux.c
- Use latest ICA engine patch from IBM.

Sun Oct 05 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-22.1
```
- rebuild
```
Thu Oct 02 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-22
```
- rebuild (22 wasn't actually built, fun eh?)
```
Wed Oct 01 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-23
```
- re-disable optimizations on ppc64
```

Wed Oct 01 2003 Joe Orton <jorton@redhat.com>

- add a_mbstr.c fix for 64-bit platforms from CVS

Wed Oct 01 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-22

- add -Wa,--noexecstack to RPM_OPT_FLAGS so that assembled modules get tagged
  as not needing executable stacks

Tue Sep 30 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-21
```
- rebuild
```
Fri Sep 26 2003 Nalin Dahyabhai <nalin@redhat.com>
```
- re-enable optimizations on ppc64
```
Fri Sep 26 2003 Nalin Dahyabhai <nalin@redhat.com>
```
- remove exclusivearch
```

Thu Sep 25 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-20

- only parse a client cert if one was requested
- temporarily exclusivearch for %{ix86}

Wed Sep 24 2003 Nalin Dahyabhai <nalin@redhat.com>

- add security fixes for protocol parsing bugs (CAN-2003-0543, CAN-2003-0544)
  and heap corruption (CAN-2003-0545)
- update RHNS-CA-CERT files
- ease back on the number of threads used in the threading test

Thu Sep 18 2003 Matt Wilson <msw@redhat.com> 0.9.7a-19
```
- rebuild to fix gzipped file md5sums (#91211)
```
Tue Aug 26 2003 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-18
```
- Updated libica to version 1.3.4.
```
Fri Jul 18 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-17
```
- rebuild
```

Wed Jul 16 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-10.9

- free the kssl_ctx structure when we free an SSL structure (#99066)

Fri Jul 11 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-16
```
- rebuild
```
Fri Jul 11 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-15
```
- lower thread test count on s390x
```
Wed Jul 09 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-14
```
- rebuild
```

Fri Jun 27 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-13

- disable assembly on arches where it seems to conflict with threading

Fri Jun 27 2003 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-12
```
- Updated libica to latest upstream version 1.3.0
```
Thu Jun 12 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-9.9
```
- rebuild
```
Thu Jun 12 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-11
```
- rebuild
```

Wed Jun 11 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-10

- ubsec: don't stomp on output data which might also be input data

Wed Jun 11 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-9
```
- temporarily disable optimizations on ppc64
```

Tue Jun 10 2003 Nalin Dahyabhai <nalin@redhat.com>

- backport fix for engine-used-for-everything from 0.9.7b
- backport fix for prng not being seeded causing problems, also from 0.9.7b
- add a check at build-time to ensure that RSA is thread-safe
- keep perlpath from stomping on the libica configure scripts

Sat Jun 07 2003 Nalin Dahyabhai <nalin@redhat.com>
```
- thread-safety fix for RSA blinding
```
Thu Jun 05 2003 Elliot Lee <sopwith@redhat.com> 0.9.7a-8
```
- rebuilt
```
Sat May 31 2003 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-7
```
- Added libica-1.2 to openssl (featurerequest).
```
Thu Apr 17 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-6
```
- fix building with incorrect flags on ppc64
```

Thu Mar 20 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-5

- add patch to harden against Klima-Pokorny-Rosa extension of Bleichenbacher's
  attack (CAN-2003-0131)

Tue Mar 18 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-4

- add patch to enable RSA blinding by default, closing a timing attack
  (CAN-2003-0147)

Thu Mar 06 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-3

- disable use of BN assembly module on x86_64, but continue to allow inline
  assembly (#83403)

Fri Feb 28 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-2
```
- disable EC algorithms
```
Thu Feb 20 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-1
```
- update to 0.9.7a
```

Thu Feb 20 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7-8

- add fix to guard against attempts to allocate negative amounts of memory
- add patch for CAN-2003-0078, fixing a timing attack

Fri Feb 14 2003 Elliot Lee <sopwith@redhat.com> 0.9.7-7
```
- Add openssl-ppc64.patch
```

Tue Feb 11 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7-6

- EVP_DecryptInit should call EVP_CipherInit() instead of EVP_CipherInit_ex(),
  to get the right behavior when passed uninitialized context structures
  (#83766)
- build with -mcpu=ev5 on alpha family (#83828)

Thu Jan 23 2003 Tim Powers <timp@redhat.com>
```
- rebuilt
```
Sat Jan 18 2003 Phil Knirsch <pknirsch@redhat.com> 0.9.7-4
```
- Added IBM hw crypto support patch.
```
Thu Jan 16 2003 Nalin Dahyabhai <nalin@redhat.com>
```
- add missing builddep on sed
```
Fri Jan 10 2003 Bill Nottingham <notting@redhat.com> 0.9.7-3
```
- debloat
- fix broken manpage symlinks
```
Thu Jan 09 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7-2
```
- fix double-free in 'openssl ca'
```
Sat Jan 04 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7-1
```
- update to 0.9.7 final
```

Wed Dec 18 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.7-0

- update to 0.9.7 beta6 (DO NOT USE UNTIL UPDATED TO FINAL 0.9.7)

Thu Dec 12 2002 Nalin Dahyabhai <nalin@redhat.com>

- update to 0.9.7 beta5 (DO NOT USE UNTIL UPDATED TO FINAL 0.9.7)

Wed Oct 23 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-30

- add configuration stanza for x86_64 and use it on x86_64
- build for linux-ppc on ppc
- start running the self-tests again

Thu Oct 03 2002 Elliot Lee <sopwith@redhat.com> 0.9.6b-29hammer.3

- Merge fixes from previous hammer packages, including general x86-64 and
  multilib

Wed Aug 07 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-29
```
- rebuild
```

Fri Aug 02 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-28

- update asn patch to fix accidental reversal of a logic check

Thu Aug 01 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-27

- update asn patch to reduce chance that compiler optimization will remove
  one of the added tests

Thu Aug 01 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-26
```
- rebuild
```
Tue Jul 30 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-25
```
- add patch to fix ASN.1 vulnerabilities
```
Fri Jul 26 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-24
```
- add backport of Ben Laurie's patches for OpenSSL 0.9.6d
```
Thu Jul 18 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-23
```
- own /usr/share/ssl/misc
```
Sat Jun 22 2002 Tim Powers <timp@redhat.com>
```
- automated rebuild
```
Mon May 27 2002 Tim Powers <timp@redhat.com>
```
- automated rebuild
```
Sat May 18 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-20
```
- free ride through the build system (whee!)
```
Fri May 17 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-19
```
- rebuild in new environment
```
Fri Apr 05 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-17, 0.9.6b-18
```
- merge RHL-specific bits into stronghold package, rename
```
Wed Apr 03 2002 Gary Benson <gbenson@redhat.com> stronghold-0.9.6c-2
```
- add support for Chrysalis Luna token
```

Wed Mar 27 2002 Gary Benson <gbenson@redhat.com>

- disable AEP random number generation, other AEP fixes

Sat Mar 16 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-15
```
- only build subpackages on primary arches
```

Fri Mar 15 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-13

- on ia32, only disable use of assembler on i386
- enable assembly on ia64

Tue Jan 08 2002 Florian La Roche <Florian.LaRoche@redhat.de> 0.9.6b-11
```
- fix sparcv9 entry
```

Tue Jan 08 2002 Gary Benson <gbenson@redhat.com> stronghold-0.9.6c-1

- upgrade to 0.9.6c
- bump BuildArch to i686 and enable assembler on all platforms
- synchronise with shrimpy and rawhide
- bump soversion to 3

Thu Oct 11 2001 Florian La Roche <Florian.LaRoche@redhat.de>
```
- delete BN_LLONG for s390x, patch from Oliver Paukstadt
```
Tue Sep 18 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-9
```
- update AEP driver patch
```

Tue Sep 11 2001 Nalin Dahyabhai <nalin@redhat.com>

- adjust RNG disabling patch to match version of patch from Broadcom

Sat Sep 08 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-8
```
- disable the RNG in the ubsec engine driver
```
Wed Aug 29 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-7
```
- tweaks to the ubsec engine driver
```
Sat Aug 25 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-6
```
- tweaks to the ubsec engine driver
```
Fri Aug 24 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-5
```
- update ubsec engine driver from Broadcom
```

Sat Aug 11 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-4

- move man pages back to %{_mandir}/man?/foo.?ssl from
  %{_mandir}/man?ssl/foo.?
- add an [ engine ] section to the default configuration file

Fri Aug 10 2001 Nalin Dahyabhai <nalin@redhat.com>

- add a patch for selecting a default engine in SSL_library_init()

Tue Jul 24 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-3

- add patches for AEP hardware support
- add patch to keep trying when we fail to load a cert from a file and
  there are more in the file
- add missing prototype for ENGINE_ubsec() in engine_int.h

Thu Jul 19 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-2
```
- actually add hw_ubsec to the engine list
```
Wed Jul 18 2001 Nalin Dahyabhai <nalin@redhat.com>
```
- add in the hw_ubsec driver from CVS
```
Thu Jul 12 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-1
```
- update to 0.9.6b
```
Fri Jul 06 2001 Nalin Dahyabhai <nalin@redhat.com>
```
- move .so symlinks back to %{_libdir}
```
Wed Jul 04 2001 Nalin Dahyabhai <nalin@redhat.com>
```
- move shared libraries to /lib (#38410)
```
Tue Jun 26 2001 Nalin Dahyabhai <nalin@redhat.com>
```
- switch to engine code base
```

Tue Jun 19 2001 Nalin Dahyabhai <nalin@redhat.com>

- add a script for creating dummy certificates
- move man pages from %{_mandir}/man?/foo.?ssl to %{_mandir}/man?ssl/foo.?

Fri Jun 08 2001 Florian La Roche <Florian.LaRoche@redhat.de>
```
- add s390x support
```

Sat Jun 02 2001 Nalin Dahyabhai <nalin@redhat.com>

- change two memcpy() calls to memmove()
- don't define L_ENDIAN on alpha

Thu May 24 2001 Joe Orton <jorton@redhat.com> stronghold-0.9.6a-1

- Add 'stronghold-' prefix to package names.
- Obsolete standard openssl packages.

Thu May 17 2001 Joe Orton <jorton@redhat.com>
```
- Add BuildArch: i586 as per Nalin's advice.
```

Wed May 16 2001 Joe Orton <jorton@redhat.com>

- Enable assembler on ix86 (using new .tar.bz2 which does
  include the asm directories).

Wed May 16 2001 Nalin Dahyabhai <nalin@redhat.com>
```
- make subpackages depend on the main package
```

Wed May 02 2001 Nalin Dahyabhai <nalin@redhat.com>

- adjust the hobble script to not disturb symlinks in include/ (fix from
  Joe Orton)

Fri Apr 27 2001 Nalin Dahyabhai <nalin@redhat.com>
```
- drop the m2crypo patch we weren't using
```
Wed Apr 25 2001 Nalin Dahyabhai <nalin@redhat.com>
```
- configure using "shared" as well
```

Mon Apr 09 2001 Nalin Dahyabhai <nalin@redhat.com>

- update to 0.9.6a
- use the build-shared target to build shared libraries
- bump the soversion to 2 because we're no longer compatible with
  our 0.9.5a packages or our 0.9.6 packages
- drop the patch for making rsatest a no-op when rsa null support is used
- put all man pages into <section>ssl instead of <section>
- break the m2crypto modules into a separate package

Wed Mar 14 2001 Nalin Dahyabhai <nalin@redhat.com>
```
- use BN_LLONG on s390
```

Tue Mar 13 2001 Nalin Dahyabhai <nalin@redhat.com>

- fix the s390 changes for 0.9.6 (isn't supposed to be marked as 64-bit)

Sun Mar 04 2001 Nalin Dahyabhai <nalin@redhat.com>

- move c_rehash to the perl subpackage, because it's a perl script now

Sat Mar 03 2001 Nalin Dahyabhai <nalin@redhat.com>

- update to 0.9.6
- enable MD2
- use the libcrypto.so and libssl.so targets to build shared libs with
- bump the soversion to 1 because we're no longer compatible with any of
  the various 0.9.5a packages circulating around, which provide lib*.so.0

Thu Mar 01 2001 Florian La Roche <Florian.LaRoche@redhat.de>
```
- change hobble-openssl for disabling MD2 again
```

Wed Feb 28 2001 Nalin Dahyabhai <nalin@redhat.com>

- re-disable MD2 -- the EVP_MD_CTX structure would grow from 100 to 152
  bytes or so, causing EVP_DigestInit() to zero out stack variables in
  apps built against a version of the library without it

Tue Feb 27 2001 Nalin Dahyabhai <nalin@redhat.com>

- disable some inline assembly, which on x86 is Pentium-specific
- re-enable MD2 (see http://www.ietf.org/ietf/IPR/RSA-MD-all)

Fri Feb 09 2001 Florian La Roche <Florian.LaRoche@redhat.de>
```
- fix s390 patch
```
Sat Dec 09 2000 Than Ngo <than@redhat.com>
```
- added support s390
```

Tue Nov 21 2000 Nalin Dahyabhai <nalin@redhat.com>

- remove -Wa,* and -m* compiler flags from the default Configure file (#20656)
- add the CA.pl man page to the perl subpackage

Fri Nov 03 2000 Nalin Dahyabhai <nalin@redhat.com>
```
- always build with -mcpu=ev5 on alpha
```
Wed Nov 01 2000 Nalin Dahyabhai <nalin@redhat.com>
```
- add a symlink from cert.pem to ca-bundle.crt
```

Thu Oct 26 2000 Nalin Dahyabhai <nalin@redhat.com>

- add a ca-bundle file for packages like Samba to reference for CA certificates

Wed Oct 25 2000 Nalin Dahyabhai <nalin@redhat.com>

- remove libcrypto's crypt(), which doesn't handle md5crypt (#19295)

Tue Oct 03 2000 Nalin Dahyabhai <nalin@redhat.com>

- add unzip as a buildprereq (#17662)
- update m2crypto to 0.05-snap4

Wed Sep 27 2000 Bill Nottingham <notting@redhat.com>

- fix some issues in building when it's not installed

Thu Sep 07 2000 Nalin Dahyabhai <nalin@redhat.com>

- make sure the headers we include are the ones we built with (aaaaarrgh!)

Sat Sep 02 2000 Nalin Dahyabhai <nalin@redhat.com>

- add Richard Henderson's patch for BN on ia64
- clean up the changelog

Wed Aug 30 2000 Nalin Dahyabhai <nalin@redhat.com>

- fix the building of python modules without openssl-devel already installed

Thu Aug 24 2000 Nalin Dahyabhai <nalin@redhat.com>

- byte-compile python extensions without the build-root
- adjust the makefile to not remove temporary files (like .key files when
  building .csr files) by marking them as .PRECIOUS

Sun Aug 20 2000 Nalin Dahyabhai <nalin@redhat.com>
```
- break out python extensions into a subpackage
```
Tue Jul 18 2000 Nalin Dahyabhai <nalin@redhat.com>
```
- tweak the makefile some more
```
Wed Jul 12 2000 Nalin Dahyabhai <nalin@redhat.com>
```
- disable MD2 support
```
Fri Jul 07 2000 Nalin Dahyabhai <nalin@redhat.com>
```
- disable MDC2 support
```

Mon Jul 03 2000 Nalin Dahyabhai <nalin@redhat.com>

- tweak the disabling of RC5, IDEA support
- tweak the makefile

Fri Jun 30 2000 Nalin Dahyabhai <nalin@redhat.com>

- strip binaries and libraries
- rework certificate makefile to have the right parts for Apache

Thu Jun 29 2000 Nalin Dahyabhai <nalin@redhat.com>

- use %{_perl} instead of /usr/bin/perl
- disable alpha until it passes its own test suite

Sat Jun 10 2000 Nalin Dahyabhai <nalin@redhat.com>

- move the passwd.1 man page out of the passwd package's way

Sat Jun 03 2000 Nalin Dahyabhai <nalin@redhat.com>

- update to 0.9.5a, modified for U.S.
- add perl as a build-time requirement
- move certificate makefile to another package
- disable RC5, IDEA, RSA support
- remove optimizations for now

Thu Mar 02 2000 Florian La Roche <Florian.LaRoche@redhat.de>
```
- Bero told me to move the Makefile into this package
```

Thu Mar 02 2000 Florian La Roche <Florian.LaRoche@redhat.de>

- add lib*.so symlinks to link dynamically against shared libs

Wed Mar 01 2000 Florian La Roche <Florian.LaRoche@redhat.de>

- update to 0.9.5
- run ldconfig directly in post/postun
- add FAQ

Sun Dec 19 1999 Bernhard Rosenkrdnzer <bero@redhat.de>
```
- Fix build on non-x86 platforms
```
Sat Nov 13 1999 Bernhard Rosenkrdnzer <bero@redhat.de>
```
- move /usr/share/ssl/* from -devel to main package
```

Wed Oct 27 1999 Bernhard Rosenkrdnzer <bero@redhat.de>

- inital packaging
- changes from base:
  - Move /usr/local/ssl to /usr/share/ssl for FHS compliance
  - handle RPM_OPT_FLAGS