Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 3 Mar 2014 13:06:25 +0000
From: Tim Brown <tmb@...35.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE Request?: konqueror - https uses all ciphers, even weak ones

On Thursday 27 February 2014 17:30:54 Marcus Meissner wrote:
> Hi,
> 
> I am wondering a bit ...
> 
> We received this bugreport for the KDE default webbrowser Konqueror:
> https://bugzilla.novell.com/show_bug.cgi?id=865241
> 
> Basically https://www.howsmyssl.com reports that even the weak
> EXPORT ciphera are in use by konqueror.
> 
> And yes, it is right...
> DES40, RC2, DES_CBC  (single DES) ... should definitely not be used these
> days anymore.
> 
> 
> Do you think use of export ciphers should get CVEs these days?
> 
> It does not seem intentional, konqueror just uses everything openssl has
> without explicit filtering by default.

Note: Not part of KDE and not speaking on their behalf, but...

IMO SSL on KDE needs some pretty big love. Pretty sure I've discussed this and 
other aspects of SSL with the relevant people at KDE before but as with many 
aspects of KDE, noones really had time to tackle it. Basically. Konqueror 
doesn't really deal with SSL, that's delegated down the stack which ends up 
with OpenSSL. There's a lot of oddities in KDEs SSL more generally but the 
original KSSL author has abandoned it (IIRC), and no one has really stepped up 
to fill the slack. 

Tim
-- 
Tim Brown
<mailto:tmb@...35.com>

[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ