romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 04:33:33 +03:00
Code Issues Projects Releases Packages Wiki Activity

vtls: refuse setting any SSL version

Browse source 
... previously they were supported if a TLS library would (unexpectedly)
still support them, but from this change they will be refused already in
curl_easy_setopt(). SSLv2 and SSLv3 have been known to be insecure for
many years now.

Closes #6773
This commit is contained in:
Daniel Stenberg 2021-03-22 13:39:37 +01:00
parent cf65d4237e
commit eff614fb02
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
8 changed files with 26 additions and 148 deletions
Download patch file Download diff file Expand all files Collapse all files

2
lib/setopt.c
View file

@ -426,6 +426,8 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
version_max = C_SSLVERSION_MAX_VALUE(arg);
if(version < CURL_SSLVERSION_DEFAULT ||
version == CURL_SSLVERSION_SSLv2 ||
version == CURL_SSLVERSION_SSLv3 ||
version >= CURL_SSLVERSION_LAST ||
version_max < CURL_SSLVERSION_MAX_NONE ||
version_max >= CURL_SSLVERSION_MAX_LAST)