oss-sec mailing list archives
default cipher suites in curl
From: Marcus Meissner <meissner () suse de>
Date: Tue, 1 Jul 2014 17:44:58 +0200
Hi, libcurl up to early this year did not have default SSL ciphers when openssl was in use. Clients using the library could however set ciphers via an option, but as it would work without, they might not have. This was fixed in curl 7.35.0: Daniel Stenberg (12 Jan 2014) - OpenSSL: deselect weak ciphers by default By default even recent versions of OpenSSL support and accept both "export strength" ciphers, small-bitsize ciphers as well as downright deprecated ones. This change sets a default cipher set that avoids the worst ciphers, and subsequently makes https://www.howsmyssl.com/a/check no longer grade curl/OpenSSL connects as 'Bad'. Bug: http://curl.haxx.se/bug/view.cgi?id=1323 Reported-by: Jeff Hodges Should it get a CVE? Ciao, Marcus
Current thread:
- default cipher suites in curl Marcus Meissner (Jul 01)
- Re: default cipher suites in curl Michael Samuel (Jul 06)
- Re: default cipher suites in curl Marcus Meissner (Jul 07)
- Re: default cipher suites in curl Michael Samuel (Jul 07)
- Re: default cipher suites in curl Marcus Meissner (Jul 07)
- Re: default cipher suites in curl Michael Samuel (Jul 06)