| commit | ce7f9caa98fc62afd5fc40c0f13bc51bef2e7fa1 | [log] [tgz] |
|---|---|---|
| author | Adam Langley <agl@chromium.org> | Fri Jun 20 12:00:00 2014 -0700 |
| committer | Adam Langley <agl@chromium.org> | Fri Jun 20 13:17:41 2014 -0700 |
| tree | e0fc1e2e12469485e447cf9a132bfa956f0feffd | |
| parent | ec48ffc1fe525fddf6f69a6d0722a5f9ce532737 [diff] |
Fix for CVE-2014-0224 Only accept change cipher spec when it is expected instead of at any time. This prevents premature setting of session keys before the master secret is determined which an attacker could use as a MITM attack. Thanks to KIKUCHI Masashi (Lepidum Co. Ltd.) for reporting this issue and providing the initial fix this patch is based on. (Imported from upstream's 77719aefb8f549ccc7f04222174889615d62057b)