Date: Mon, 7 Jul 2014 12:46:42 +1000 From: Michael Samuel <mik@...net.net> To: oss-security@...ts.openwall.com Subject: Re: default cipher suites in curl Hi, On 2 July 2014 01:44, Marcus Meissner <meissner@...e.de> wrote: > Clients using the library could however set ciphers via > an option, but as it would work without, they might not have. This will only happen when the server either doesn't support stronger ciphers or when the server requests it's cipher order be honoured and chooses export ciphers first. An attacker can't trigger this with SSLv3 or TLS. > Should it get a CVE? If a weak cipher was negotiated, it's because the server preferred this and the client didn't care. There's no trust boundary crossed. An argument could be made that the clients would rather not establish a connection at all than negotiate a weak cipher. Not sure if that counts for CVE or just hardening? Either way, this is a workaround for an OpenSSL bug. Regards, Michael
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ