From 50d1d92de9a4cf62723a3c1ea2f39501feea7d6e Mon Sep 17 00:00:00 2001 From: Pauli Date: Wed, 4 May 2022 11:26:02 +1000 Subject: [PATCH] Correct NEWS entry about required security level for old versions of TLS, DTLS and SSL The entry was incorrect because suites using RSA key exchange without SHA1 were permitted at security level 1. Partial fix for #18194 Reviewed-by: Tomas Mraz Reviewed-by: Matt Caswell Reviewed-by: Shane Lontis (Merged from https://github.com/openssl/openssl/pull/18234) (cherry picked from commit 3226a37a4875567f2bf49aa44a727bcb67bb7dcd) --- NEWS.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/NEWS.md b/NEWS.md index 630c57ae53..6f741ee61a 100644 --- a/NEWS.md +++ b/NEWS.md @@ -122,7 +122,8 @@ OpenSSL 3.0 RC4, RC5 and SEED cipher functions have been deprecated. * All of the low-level DH, DSA, ECDH, ECDSA and RSA public key functions have been deprecated. - * SSL 3, TLS 1.0, TLS 1.1, and DTLS 1.0 only work at security level 0. + * SSL 3, TLS 1.0, TLS 1.1, and DTLS 1.0 only work at security level 0, + except when RSA key exchange without SHA1 is used. * Added providers, a new pluggability concept that will replace the ENGINE API and ENGINE implementations.