Updated: openssl-0.9.7b-1, openssl-devel-0.9.7b-1

Corinna Vinschen corinna-cygwin@cygwin.com
Tue Sep 30 19:43:00 GMT 2003

I've updated the version of OpenSSL to 0.9.7c-1.  This also includes the
openssl-devel package.

This is a bugfix and security update.

The Cygwin version matches the official source tree except for a minor
tweak in the top level Makefile.


There will be no 0.9.6j compatibility package anymore.  The 0.9.6
package is only kept for backward compatibility of packages built
for Cygwin 1.3.x.  I strongly recommend to upgrade packages to
Cygwin 1.5.x and then automatically to OpenSSL-0.9.7c ASAP.


The official release announcement text as of today follows:

  OpenSSL version 0.9.7c and 0.9.6k released

  OpenSSL - The Open Source toolkit for SSL/TLS

  The OpenSSL project team is pleased to announce the release of
  version 0.9.7c of our open source toolkit for SSL/TLS.  This new
  OpenSSL version is a security and bugfix release and incorporates
  changes and bugfixes to the toolkit (for a complete list see
  http://www.openssl.org/source/exp/CHANGES ).

  We also release 0.9.6k, which contains the same security bugfix as
  0.9.7c and a few more small bugfixes compared to 0.9.6j.

  For more details of the security issues being fixed in this release
  please see http://www.openssl.org/news/secadv_20030930.txt

  The most significant changes are:

    o Security: fix vulnerabilities in ASN.1 parsing
      CAN-2003-0543, CAN-2003-0544                            [0.9.7c & 0.9.6k] 
    o Security: fix additional vulnerability in ASN.1 parsing
      CAN-2003-0545                                                    [0.9.7c]
    o Only accept a client cert if the server requests one    [0.9.7c & 0.9.6k] 
    o Various S/MIME bug and compatibility fixes                       [0.9.7c]

  We consider OpenSSL 0.9.7c to be the best version of OpenSSL available
  and we strongly recommend that users of older versions upgrade as
  soon as possible.  OpenSSL 0.9.7c is available for download via HTTP
  and FTP from the following master locations (you can find the various
  FTP mirrors under http://www.openssl.org/source/mirror.html):

    o http://www.openssl.org/source/
    o ftp://ftp.openssl.org/source/

  For those who want or have to stay with the 0.9.6 series of OpenSSL,
  we strongly recommend that you upgrade to OpenSSL 0.9.6k as soon as
  possible.  It's available in the same location as 0.9.7c.

To update your installation, click on the "Install Cygwin now" link on
the http://cygwin.com/ web page.  This downloads setup.exe to your
system.  Once you've downloaded setup.exe, run it and select "Net"
("Devel" for the openssl-devel package) and then click on the appropriate
field until the above announced version number appears if it is not
displayed already.

If you have questions or comments, please send them to the Cygwin
mailing list at: cygwin@cygwin.com .  I would appreciate it if you would
use this mailing list rather than emailing me directly.  This includes
ideas and comments about the setup utility or Cygwin in general.

If you want to make a point or ask a question, the Cygwin mailing list
is the appropriate place.


If you want to unsubscribe from the cygwin-announce mailing list, look
at the "List-Unsubscribe: " tag in the email header of this message.
Send email to the address specified there.  It will be in the format:


If you need more information on unsubscribing, start reading here:


Please read *all* of the information on unsubscribing that is available
starting at this URL.

I implore you to READ this information before sending email about how
you "tried everything" to unsubscribe.  In 100% of the cases where
people were unable to unsubscribe, the problem was that they hadn't
actually read and comprehended the unsubscribe instructions.

If you need to unsubscribe from cygwin-announce or any other mailing
list, reading the instructions at the above URL is guaranteed to
provide you with the info that you need.

Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Developer                                mailto:cygwin@cygwin.com
Red Hat, Inc.

More information about the Cygwin-announce mailing list