generic-library/curl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

OpenSSL: Disable SSL/TLS compression

Browse Source 
It either causes increased memory usage or exposes users
to the "CRIME attack" (CVE-2012-4929)
This commit is contained in:
Cristian Rodríguez
2012-11-12 16:41:58 +01:00
committed by Daniel Stenberg
parent 38ed72cd37
commit fa1ae0abcd
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
lib/ssluse.c
View File

@@ -1501,6 +1501,10 @@ ossl_connect_step1(struct connectdata *conn,
ctx_options |= SSL_OP_NO_TICKET; ctx_options |= SSL_OP_NO_TICKET;
#endif #endif
#ifdef SSL_OP_NO_COMPRESSION
ctx_options |= SSL_OP_NO_COMPRESSION;
#endif
#ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG #ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
/* mitigate CVE-2010-4180 */ /* mitigate CVE-2010-4180 */
ctx_options &= ~SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG; ctx_options &= ~SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG;