Re: CVE request: ejabberd compression allows cirucumvention of encryption despite starttls_required

[Michael Samuel <mik () miknet net>]

Hi,

On 14 October 2014 18:21, Hanno Böck <hanno () hboeck de> wrote:
> E.g. the client will check the server config on the first connection
> and use that settings in the future.
>
> So there is a scenario where this leads to unintended unencrypted
> connections.

Ok, I agree - this allows non-broken clients to have an insecure
configuration, when the expectation is that they wouldn't.

Regards,
  Michael