Red Hat Bugzilla – Bug 1156422
curl does not allow explicit control of DHE ciphers
Last modified: 2015-07-22 01:44:03 EDT
Created attachment 950380 [details] Patch to add missing cipher names. +++ This bug was initially created as a clone of Bug #1156410 +++ Description of problem: curl has a list of ciphers that are not enabled by default that it adds to the library default selection in the absence of any explicit ciphers. /* following ciphers are new in NSS 3.4 and not enabled by default, therefore they are enabled explicitly */ static const int enable_ciphers_by_default[] = { TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, SSL_NULL_WITH_NULL_NULL }; Unfortunately these ciphers are not made available in the list of choosable ciphers and so cannot be explicitly selected for use. Version-Release number of selected component (if applicable): curl-7.19.7
Comment on attachment 950380 [details] Patch to add missing cipher names. Thanks for the patch. However, we need to use the upstream solution in order to stay compatible with newer releases: https://github.com/bagder/curl/compare/4c599b9d2d...67061e3f4e
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2015-1254.html