Re: default cipher suites in curl

[Michael Samuel <mik () miknet net>]

Hi,

On 2 July 2014 01:44, Marcus Meissner <meissner () suse de> wrote:
> Clients using the library could however set ciphers via
> an option, but as it would work without, they might not have.

This will only happen when the server either doesn't support stronger
ciphers or when the server requests it's cipher order be honoured and
chooses export ciphers first.   An attacker can't trigger this with SSLv3
or TLS.

> Should it get a CVE?

If a weak cipher was negotiated, it's because the server preferred this and
the client didn't care.  There's no trust boundary crossed.

An argument could be made that the clients would rather not establish a
connection at all than negotiate a weak cipher.  Not sure if that counts for
CVE or just hardening?

Either way, this is a workaround for an OpenSSL bug.

Regards,
  Michael