Bug 1090952
Summary: | Do not send ECC ciphersuites in SSLv2 client hello | |||
---|---|---|---|---|
Product: | Red Hat Enterprise Linux 6 | Reporter: | Tomas Mraz <tmraz> | |
Component: | openssl | Assignee: | Tomas Mraz <tmraz> | |
Status: | CLOSED ERRATA | QA Contact: | Alicja Kario <hkario> | |
Severity: | medium | Docs Contact: | ||
Priority: | medium | |||
Version: | 6.5 | CC: | ddas, hkario, jherrman, ppisar, psabata, tmraz | |
Target Milestone: | rc | |||
Target Release: | --- | |||
Hardware: | x86_64 | |||
OS: | Linux | |||
URL: | http://cpansearch.perl.org/src/MIKEM/Net-SSLeay-1.56/Changes | |||
Whiteboard: | ||||
Fixed In Version: | openssl-1.0.1e-26.el6 | Doc Type: | Bug Fix | |
Doc Text: |
In TLS client applications that use SSLv2 ClientHello requests, the support for Elliptic Curve Cryptography (ECC)-based cipher suites was previously advertised, but the TLS extension giving the list of supported elliptic curves could not be sent. This caused a TLS connection to a server which used an elliptic curve not supported by the OpenSSL client to abort. With this update, the ECC-based cipher suites are not sent in the SSLv2 ClientHello request, and TLS connections are no longer aborted in the above circumstances.
|
Story Points: | --- | |
Clone Of: | 1044401 | |||
: | 1090955 (view as bug list) | Environment: | ||
Last Closed: | 2014-10-14 07:19:52 UTC | Type: | Bug | |
Regression: | --- | Mount Type: | --- | |
Documentation: | --- | CRM: | ||
Verified Versions: | Category: | --- | ||
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
Cloudforms Team: | --- | Target Upstream Version: | ||
Embargoed: |
Description
Tomas Mraz
2014-04-24 12:59:17 UTC
Also I am currently evaluating the possibility of removing SSLv2 cipher suites from the ALL list. But this should be probably rather RHEL-7 change. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2014-1525.html |