[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CACYkhxgo2-hoBHXPikQCu6gdTN6wuM9fmsc-2xTaU9saVmP5mg@mail.gmail.com>
Date: Mon, 7 Jul 2014 12:46:42 +1000
From: Michael Samuel <mik@...net.net>
To: oss-security@...ts.openwall.com
Subject: Re: default cipher suites in curl
Hi,
On 2 July 2014 01:44, Marcus Meissner <meissner@...e.de> wrote:
> Clients using the library could however set ciphers via
> an option, but as it would work without, they might not have.
This will only happen when the server either doesn't support stronger
ciphers or when the server requests it's cipher order be honoured and
chooses export ciphers first. An attacker can't trigger this with SSLv3
or TLS.
> Should it get a CVE?
If a weak cipher was negotiated, it's because the server preferred this and
the client didn't care. There's no trust boundary crossed.
An argument could be made that the clients would rather not establish a
connection at all than negotiate a weak cipher. Not sure if that counts for
CVE or just hardening?
Either way, this is a workaround for an OpenSSL bug.
Regards,
Michael
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
