Topic: OpenSSL releases November 20 - LOW severity

[Jan-E]

The OpenSSL project team would like to announce the forthcoming release of OpenSSL versions 1.1.1a, 1.1.0j and 1.0.2q.

These releases will be made available on 20th November 2018 between approximately 1300-1700 UTC.

These are bug-fix releases. They also contain the fixes for three LOW severity security issues CVE-2018-0735, CVE-2018-0734 and CVE-2018-5407 which were previously announced here:

https://www.openssl.org/news/secadv/20181029.txt
https://www.openssl.org/news/secadv/20181030.txt
https://www.openssl.org/news/secadv/20181112.txt

CVE-2018-0735 only affects the 1.1.0 branch.
CVE-2018-0734 affects the 1.1.1, 1.1.0 and 1.0.2 branches.
CVE-2018-5407 affects the 1.0.2 branch. It also affects older 1.1.0 releases before 1.1.0i.

Yours

The OpenSSL Project Team

[Jan-E]

OpenSSL 1.0.2q Fips builds can be found here:

https://ci.appveyor.com/project/Jan-E/openssl-fips/builds/20461068

And here:
https://ci.appveyor.com/project/Jan-E/openssl-fips/builds/20461101

Open a job, goto the artifacts tab, download the zip