diff --git a/CHANGES b/CHANGES
index def90c2446..2476e8c41f 100644
--- a/CHANGES
+++ b/CHANGES
@@ -7,6 +7,8 @@
 2523.	[bug]		Random type rdata freed by dns_nsec_typepresent().
 			[RT #19112]
 
+2522.	[security]	Handle -1 from DSA_do_verify().
+
 2521.	[bug]		Improve epoll cross compilation support. [RT #19047]
 
 2519.	[bug]		dig/host with -4 or -6 didn't work if more than two
diff --git a/lib/dns/api b/lib/dns/api
index 939a2b31b1..c8e6ef1671 100644
--- a/lib/dns/api
+++ b/lib/dns/api
@@ -1,3 +1,3 @@
 LIBINTERFACE = 45
-LIBREVISION = 2
+LIBREVISION = 4
 LIBAGE = 0
diff --git a/lib/dns/openssldsa_link.c b/lib/dns/openssldsa_link.c
index 1d971f1d8c..d6ef5cd8ca 100644
--- a/lib/dns/openssldsa_link.c
+++ b/lib/dns/openssldsa_link.c
@@ -29,7 +29,7 @@
  * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: openssldsa_link.c,v 1.11 2007/08/28 07:20:42 tbox Exp $ */
+/* $Id: openssldsa_link.c,v 1.11.92.1 2009/01/14 17:41:12 fdupont Exp $ */
 
 #ifdef OPENSSL
 
@@ -146,7 +146,7 @@ openssldsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
 
 	status = DSA_do_verify(digest, ISC_SHA1_DIGESTLENGTH, dsasig, dsa);
 	DSA_SIG_free(dsasig);
-	if (status == 0)
+	if (status != 1)
 		return (dst__openssl_toresult(DST_R_VERIFYFAILURE));
 
 	return (ISC_R_SUCCESS);
diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c
index fa426b38b4..517585018e 100644
--- a/lib/dns/opensslrsa_link.c
+++ b/lib/dns/opensslrsa_link.c
@@ -17,7 +17,7 @@
 
 /*
  * Principal Author: Brian Wellington
- * $Id: opensslrsa_link.c,v 1.16 2007/06/19 23:47:16 tbox Exp $
+ * $Id: opensslrsa_link.c,v 1.16.128.1 2009/01/14 17:41:12 fdupont Exp $
  */
 #ifdef OPENSSL
 
@@ -247,7 +247,7 @@ opensslrsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
 
 	status = RSA_verify(type, digest, digestlen, sig->base,
 			    RSA_size(rsa), rsa);
-	if (status == 0)
+	if (status != 1)
 		return (dst__openssl_toresult(DST_R_VERIFYFAILURE));
 
 	return (ISC_R_SUCCESS);