oss-security - default cipher suites in curl

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140701154458.GC4636@suse.de>
Date: Tue, 1 Jul 2014 17:44:58 +0200
From: Marcus Meissner <meissner@...e.de>
To: OSS Security List <oss-security@...ts.openwall.com>
Subject: default cipher suites in curl

Hi,

libcurl up to early this year did not have default SSL ciphers
when openssl was in use.

Clients using the library could however set ciphers via 
an option, but as it would work without, they might not have.

This was fixed in curl 7.35.0:

Daniel Stenberg (12 Jan 2014)
- OpenSSL: deselect weak ciphers by default

  By default even recent versions of OpenSSL support and accept both
  "export strength" ciphers, small-bitsize ciphers as well as downright
  deprecated ones.

  This change sets a default cipher set that avoids the worst ciphers, and
  subsequently makes https://www.howsmyssl.com/a/check no longer grade
  curl/OpenSSL connects as 'Bad'.

  Bug: http://curl.haxx.se/bug/view.cgi?id=1323
  Reported-by: Jeff Hodges

Should it get a CVE?

Ciao, Marcus

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.