oss-sec mailing list archives
Re: CVE Request?: konqueror - https uses all ciphers, even weak ones
From: Tim Brown <tmb () 65535 com>
Date: Mon, 3 Mar 2014 13:06:25 +0000
On Thursday 27 February 2014 17:30:54 Marcus Meissner wrote:
Hi, I am wondering a bit ... We received this bugreport for the KDE default webbrowser Konqueror: https://bugzilla.novell.com/show_bug.cgi?id=865241 Basically https://www.howsmyssl.com reports that even the weak EXPORT ciphera are in use by konqueror. And yes, it is right... DES40, RC2, DES_CBC (single DES) ... should definitely not be used these days anymore. Do you think use of export ciphers should get CVEs these days? It does not seem intentional, konqueror just uses everything openssl has without explicit filtering by default.
Note: Not part of KDE and not speaking on their behalf, but... IMO SSL on KDE needs some pretty big love. Pretty sure I've discussed this and other aspects of SSL with the relevant people at KDE before but as with many aspects of KDE, noones really had time to tackle it. Basically. Konqueror doesn't really deal with SSL, that's delegated down the stack which ends up with OpenSSL. There's a lot of oddities in KDEs SSL more generally but the original KSSL author has abandoned it (IIRC), and no one has really stepped up to fill the slack. Tim -- Tim Brown <mailto:tmb () 65535 com>
Attachment:
signature.asc
Description: This is a digitally signed message part.
Current thread:
- CVE Request?: konqueror - https uses all ciphers, even weak ones Marcus Meissner (Feb 27)
- Re: CVE Request?: konqueror - https uses all ciphers, even weak ones Tim Brown (Mar 03)
- Re: CVE Request?: konqueror - https uses all ciphers, even weak ones Kurt Seifried (Mar 03)
- Re: CVE Request?: konqueror - https uses all ciphers, even weak ones cve-assign (Mar 03)
- Re: Re: CVE Request?: konqueror - https uses all ciphers, even weak ones Daniel Kahn Gillmor (Mar 04)
- Re: CVE Request?: konqueror - https uses all ciphers, even weak ones John Haxby (Mar 04)
- Re: CVE Request?: konqueror - https uses all ciphers, even weak ones Daniel Kahn Gillmor (Mar 04)
- Re: CVE Request?: konqueror - https uses all ciphers, even weak ones Daniel Kahn Gillmor (Mar 04)
- Re: CVE Request?: konqueror - https uses all ciphers, even weak ones John Haxby (Mar 04)
- Re: CVE Request?: konqueror - https uses all ciphers, even weak ones Daniel Kahn Gillmor (Mar 04)
- Re: CVE Request?: konqueror - https uses all ciphers, even weak ones Jann Horn (Mar 04)
- Re: CVE Request?: konqueror - https uses all ciphers, even weak ones Felix Eckhofer (Mar 04)
- Re: CVE Request?: konqueror - https uses all ciphers, even weak ones Kurt Seifried (Mar 03)
- Re: CVE Request?: konqueror - https uses all ciphers, even weak ones Tim Brown (Mar 03)