romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-04 14:56:19 +03:00
Code Issues Projects Releases Packages Wiki Activity

curl: ignore options asking for SSLv2 or SSLv3

Browse source 
Instead output a warning about it and continue with the defaults.

These SSL versions are typically not supported by the TLS libraries since a
long time back already since they are inherently insecure and broken. Asking
for them to be used will just cause an error to be returned slightly later.

In the unlikely event that a user's TLS library actually still supports these
protocol versions, this change might make the request a little less insecure.

Closes #6772
This commit is contained in:
Daniel Stenberg 2021-03-22 11:55:27 +01:00
parent 6fc805d0c1
commit cf65d4237e
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 7 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/tool_getparam.c
View file

@ -1306,11 +1306,11 @@ ParameterError getparameter(const char *flag, /* f or -long-flag */
break;
case '2':
/* SSL version 2 */
config->ssl_version = CURL_SSLVERSION_SSLv2;
warnf(global, "Ignores instruction to use SSLv2\n");
break;
case '3':
/* SSL version 3 */
config->ssl_version = CURL_SSLVERSION_SSLv3;
warnf(global, "Ignores instruction to use SSLv3\n");
break;
case '4':
/* IPv4 */