Re: [openssl-project] OpenSSL version 1.0.2q published

Hong Cho <hongcho@xxxxxxxxx> · Wed, 27 Feb 2019 08:28:17 +0900

I see no code change between 1.0.2q and 1.0.2r.

------
# diff -dup openssl-1.0.2q openssl-1.0.2r |& grep '^diff' | awk '{print $4}'
openssl-1.0.2r/CHANGES
openssl-1.0.2r/Makefile
openssl-1.0.2r/Makefile.org
openssl-1.0.2r/NEWS
openssl-1.0.2r/README
openssl-1.0.2r/openssl.spec
hongch@hongch_bldx:~/downloads> diff -dup openssl-1.0.2q openssl-1.0.2r | & grep '^Only'
Only in openssl-1.0.2q: Makefile.bak
------

It's supposed have a fix for CVE-2019-1559? Am I missing something?

Hong.

On Tue, Nov 20, 2018 at 11:17 PM OpenSSL <openssl@xxxxxxxxxxx> wrote:
-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA512

   OpenSSL version 1.0.2q released

   ===============================

   OpenSSL - The Open Source toolkit for SSL/TLS

   https://www.openssl.org/

   The OpenSSL project team is pleased to announce the release of

   version 1.0.2q of our open source toolkit for SSL/TLS. For details

   of changes and known issues see the release notes at:

        https://www.openssl.org/news/openssl-1.0.2-notes.html

   OpenSSL 1.0.2q is available for download via HTTP and FTP from the

   following master locations (you can find the various FTP mirrors under

   https://www.openssl.org/source/mirror.html):

     * https://www.openssl.org/source/

     * ftp://ftp.openssl.org/source/

   The distribution file name is:

    o openssl-1.0.2q.tar.gz

      Size: 5345604

      SHA1 checksum: 692f5f2f1b114f8adaadaa3e7be8cce1907f38c5

      SHA256 checksum: 5744cfcbcec2b1b48629f7354203bc1e5e9b5466998bbccc5b5fcde3b18eb684

   The checksums were calculated using the following commands:

    openssl sha1 openssl-1.0.2q.tar.gz

    openssl sha256 openssl-1.0.2q.tar.gz

   Yours,

   The OpenSSL Project Team.