--- rpms/openssl/sme8/openssl.spec	2014/02/18 03:03:10	1.1
+++ rpms/openssl/sme8/openssl.spec	2014/09/02 22:20:55	1.3
@@ -21,7 +21,7 @@
 Summary: The OpenSSL toolkit
 Name: openssl
 Version: 0.9.8e
-Release: 27%{?dist}.1
+Release: 27%{?dist}.4
 # The tarball is based on the openssl-fips-1.2.0-test.tar.gz tarball
 Source: openssl-fips-%{version}-usa.tar.bz2
 Source1: hobble-openssl
@@ -94,6 +94,12 @@ Patch104: openssl-fips-0.9.8e-cve-2012-2
 Patch105: openssl-fips-0.9.8e-secure-getenv.patch
 Patch106: openssl-fips-0.9.8e-cve-2013-0166.patch
 Patch107: openssl-fips-0.9.8e-cve-2013-0169.patch
+Patch108: openssl-fips-0.9.8e-cve-2014-0224.patch
+Patch109: openssl-fips-0.9.8e-cve-2014-0221.patch
+Patch110: openssl-fips-0.9.8e-cve-2014-3505.patch
+Patch111: openssl-fips-0.9.8e-cve-2014-3506.patch
+Patch112: openssl-fips-0.9.8e-cve-2014-3508.patch
+Patch113: openssl-fips-0.9.8e-cve-2014-3510.patch
 
 License: BSDish
 Group: System Environment/Libraries
@@ -195,6 +201,12 @@ from other formats to the formats used b
 %patch105 -p1 -b .secure-getenv
 %patch106 -p1 -b .ocsp-dos
 %patch107 -p1 -b .lucky13
+%patch108 -p1 -b .keying-mitm
+%patch109 -p1 -b .dtls-recursion
+%patch110 -p1 -b .dtls-doublefree
+%patch111 -p1 -b .dtls-sizechecks
+%patch112 -p1 -b .oid-handling
+%patch113 -p1 -b .adh-dos
 
 # Modify the various perl scripts to reference perl in the right location.
 perl util/perlpath.pl `dirname %{__perl}`
@@ -448,6 +460,16 @@ rm -rf $RPM_BUILD_ROOT/%{_bindir}/openss
 %postun -p /sbin/ldconfig
 
 %changelog
+* Fri Aug  8 2014 Tomas Mraz <tmraz@redhat.com> 0.9.8e-27.4
+- fix CVE-2014-0221 - recursion in DTLS code leading to DoS
+- fix CVE-2014-3505 - doublefree in DTLS packet processing
+- fix CVE-2014-3506 - avoid memory exhaustion in DTLS
+- fix CVE-2014-3508 - fix OID handling to avoid information leak
+- fix CVE-2014-3510 - fix DoS in anonymous (EC)DH handling in DTLS
+
+* Tue Jun  3 2014 Tomas Mraz <tmraz@redhat.com> 0.9.8e-27.3
+- fix for CVE-2014-0224 - SSL/TLS MITM vulnerability
+
 * Tue Jan 28 2014 Tomas Mraz <tmraz@redhat.com> 0.9.8e-27.1
 - replace expired GlobalSign Root CA certificate in ca-bundle.crt