OpenSSL is a toolkit that implements the Secure Sockets Layer and Transport Layer Security protocols, as well as a full-strength general-purpose cryptography library. Security Fix: * openssl: X.400 address type confusion in X.509 GeneralName * openssl: read buffer overflow in X.509 certificate verification * openssl: timing attack in RSA Decryption implementation * openssl: double free after calling PEM_read_bio_ex * openssl: use-after-free following BIO_new_NDEF * openssl: invalid pointer dereference in d2i_PKCS7 functions * openssl: NULL dereference validating DSA public key * openssl: NULL dereference during PKCS7 data verification For more details about the security issue, including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section. Bug Fix: * HMAC generation should reject key lengths