Summarized Changelog:
- Fix a bug where the name constraint extension did not constrain the alternative DN field which can be included in a subject alternative name
- Fix a bug in the TLS server during client authentication where where if a static RSA ciphersuite was selected, then no certificate request would be sent
- Change the HMAC key schedule to attempt to reduce the information leaked from the key schedule with regards to the length of the key
- Add Processor_RNG which wraps RDRAND or the POWER DARN RNG instructions
- Fix a memory leak in the CommonCrypto block cipher calls
- Workaround a bug in GCC's UbSan which triggered on a code sequence in XMSS
Full changelog available here