|
27 | 27 | </header>
|
28 | 28 | <p>This document describes the changes made to the SSL application.</p>
|
29 | 29 |
|
| 30 | +<section><title>SSL 10.9.1.7</title> |
| 31 | + |
| 32 | + <section><title>Fixed Bugs and Malfunctions</title> |
| 33 | + <list> |
| 34 | + <item> |
| 35 | + <p>Avoid generating an internal alert for case that |
| 36 | + should have been an orderly shutdown by the supervisor. |
| 37 | + </p> |
| 38 | + <p> |
| 39 | + Own Id: OTP-19311 Aux Id: PR-8980 </p> |
| 40 | + </item> |
| 41 | + <item> |
| 42 | + <p>If present, extended key-usage TLS (SSL) role check |
| 43 | + (<c>pk-clientAuth</c>, <c>pk-serverAuth</c>) should |
| 44 | + always be performed for peer-cert. An intermediate CA |
| 45 | + cert may relax the requirement if |
| 46 | + <c>AnyExtendedKeyUsage</c> purpose is present.</p> |
| 47 | + <p>In OTP-25.3.2.8, OTP-26.2 and OTP-27.0 these |
| 48 | + requirements became too relaxed. There where two |
| 49 | + problems, firstly the peer cert extension was only |
| 50 | + checked if it was marked critical, and secondly the CA |
| 51 | + cert check did not assert the relaxed |
| 52 | + <c>AnyExtendedKeyUsage</c> purpose.</p> |
| 53 | + <p>This could result in that certificates might be |
| 54 | + misused for purposes not intended by the certificate |
| 55 | + authority.</p> |
| 56 | + <p>Thanks to Bryan Paxton for reporting the issue.</p> |
| 57 | + <p> |
| 58 | + Own Id: OTP-19352 Aux Id: PR-9130, CVE-2024-53846, |
| 59 | + OTP-19240 </p> |
| 60 | + </item> |
| 61 | + </list> |
| 62 | + </section> |
| 63 | + |
| 64 | +</section> |
| 65 | + |
30 | 66 | <section><title>SSL 10.9.1.6</title>
|
31 | 67 |
|
32 | 68 | <section><title>Fixed Bugs and Malfunctions</title>
|
|
0 commit comments