View Issue Details

Jump to NotesJump to History
IDProjectCategoryView StatusDate SubmittedLast Update
0003391libmicrohttpdpublic2014-04-28 15:202021-09-02 15:54
Reportermsmeissn Assigned ToChristian Grothoff Due Date
PrioritynormalSeveritymajorReproducibilityalways
Status closedResolutionfixed 
PlatformLinuxOSLinux 
Product VersionGit master 
Target Version0.9.35Fixed in Version0.9.35 
Summary0003391: insecure default cipher left from debugging
Descriptionlibmicrohttpd-0.9.30/src/microspdy/io_openssl.c
has:
        //TODO only RC4-SHA is used to make it easy to debug with wireshark
    if (1 != SSL_CTX_set_cipher_list(daemon->io_context, "RC4-SHA"))
    {
                SPDYF_DEBUG("Couldn't set the desired cipher list");
                SSL_CTX_free(daemon->io_context);
                return SPDY_NO;
        }
        


This is an insecure cipher... and probably left from debugging.

Please use the default openssl cipher suite at least.
Steps To Reproducesource review
TagsNo tags attached.

Activities

Christian Grothoff

2014-05-02 18:43

manager   ~0008276

Switched to "HIGH" in SVN 33158. Thanks for reporting.

Christian Grothoff

2021-09-02 15:54

manager   ~0018206

Fix committed to master branch.

Issue History

Date ModifiedUsernameFieldChange
2014-04-28 15:20msmeissnNew Issue
2014-05-02 18:43Christian GrothoffNote Added: 0008276
2014-05-02 18:43Christian GrothoffStatusnew => resolved
2014-05-02 18:43Christian GrothoffFixed in Version => 0.9.35
2014-05-02 18:43Christian GrothoffResolutionopen => fixed
2014-05-02 18:43Christian GrothoffAssigned To => Christian Grothoff
2014-05-02 18:43Christian GrothoffProduct Version => Git master
2014-05-02 18:43Christian GrothoffTarget Version => 0.9.35
2014-05-02 18:44Christian GrothoffReproducibilityhave not tried => always
2014-05-02 18:52Christian GrothoffStatusresolved => closed
2016-04-09 14:54Christian GrothoffCategorySPDY TLS => (No Category)
2021-09-02 15:54Christian Grothoff
2021-09-02 15:54Christian GrothoffNote Added: 0018206