Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 7 Jul 2014 12:46:42 +1000
From: Michael Samuel <mik@...net.net>
To: oss-security@...ts.openwall.com
Subject: Re: default cipher suites in curl

Hi,

On 2 July 2014 01:44, Marcus Meissner <meissner@...e.de> wrote:
> Clients using the library could however set ciphers via
> an option, but as it would work without, they might not have.

This will only happen when the server either doesn't support stronger
ciphers or when the server requests it's cipher order be honoured and
chooses export ciphers first.   An attacker can't trigger this with SSLv3
or TLS.

> Should it get a CVE?

If a weak cipher was negotiated, it's because the server preferred this and
the client didn't care.  There's no trust boundary crossed.

An argument could be made that the clients would rather not establish a
connection at all than negotiate a weak cipher.  Not sure if that counts for
CVE or just hardening?

Either way, this is a workaround for an OpenSSL bug.

Regards,
  Michael

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.