Doc: short description of CVE-2016-9963

[exim.git] / doc / doc-txt / ChangeLog

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 6532b1ced89f27399d1e709cc230480b15ea4aa4..926a36dc1647a35a2f7cc2b3b327485fc4722187 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -140,6 +140,12 @@ HS/01 Fix leak in verify callout under GnuTLS, about 3MB per recipient on
 HS/02 Bug 1802: Do not half-close the connection after sending a request
       to rspamd.
 
+HS/03 Use "auto" as the default EC curve parameter. For OpenSSL < 1.0.2
+      fallback to "prime256v1".
+
+JH/34 SECURITY: Use proper copy of DATA command in error message.
+      Could leak key material.  Remotely explaoitable.  CVE-2016-9963.
+
 
 Exim version 4.87
 -----------------