X-Git-Url: http://sjero.net/git/?p=wget;a=blobdiff_plain;f=NEWS;h=4467817c68cf58ebc9737ca625d01c843c08f015;hp=559558e741397b0e4f01bf901f3fe792aeda7553;hb=edc9055768fed952b30629a9e8fa38ef68761882;hpb=9dadbf6fe9577a6a6b7e7bab4e4b782fc1a6f86c

diff --git a/NEWS b/NEWS
index 559558e7..4467817c 100644
--- a/NEWS
+++ b/NEWS
@@ -10,6 +10,10 @@ Please send GNU Wget bug reports to <bug-wget@gnu.org>.
 
 ** Mailing list MOVED to bug-wget@gnu.org
 
+** SECURITY FIX: It had been possible to trick Wget into accepting
+SSL certificates that don't match the host name, through the trick of
+embedding NUL characters into the certs' common name.
+
 ** Added support for CSS. This includes:
      - Parsing links from CSS files, and from CSS content found in HTML
        style tags and attributes.
@@ -28,6 +32,9 @@ are translated from their source encoding to UTF-8 before percent-encoding.
    IRI support was added by Saint Xavier <wget@sxav.eu>, as his
    project for the Google Summer of Code.
 
+** Wget now provides more sensible exit status codes when downloads
+don't proceed as expected (see the manual).
+
 ** --default-page option (and associated wgetrc command) added to
 support alternative default names for index.html.