Date: Tue, 1 Jul 2014 17:44:58 +0200 From: Marcus Meissner <meissner@...e.de> To: OSS Security List <oss-security@...ts.openwall.com> Subject: default cipher suites in curl Hi, libcurl up to early this year did not have default SSL ciphers when openssl was in use. Clients using the library could however set ciphers via an option, but as it would work without, they might not have. This was fixed in curl 7.35.0: Daniel Stenberg (12 Jan 2014) - OpenSSL: deselect weak ciphers by default By default even recent versions of OpenSSL support and accept both "export strength" ciphers, small-bitsize ciphers as well as downright deprecated ones. This change sets a default cipher set that avoids the worst ciphers, and subsequently makes https://www.howsmyssl.com/a/check no longer grade curl/OpenSSL connects as 'Bad'. Bug: http://curl.haxx.se/bug/view.cgi?id=1323 Reported-by: Jeff Hodges Should it get a CVE? Ciao, Marcus
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ