+2009-08-27 Micah Cowan <micah@cowan.name>
+
+ * NEWS: Add mention of the NUL characters SSL security fix.
+
2009-07-28 Micah Cowan <micah@cowan.name>
* NEWS: Mention some more previously undocumented items, the
** Mailing list MOVED to bug-wget@gnu.org
+** SECURITY FIX: It had been possible to trick Wget into accepting
+SSL certificates that don't match the host name, through the trick of
+embedding NUL characters into the certs' common name.
+
** Added support for CSS. This includes:
- Parsing links from CSS files, and from CSS content found in HTML
style tags and attributes.