moparisthebest
/
curl
mirror of https://github.com/moparisthebest/curl
1
0
Fork 0
Code Issues Releases Wiki Activity

OpenSSL: Disable SSL/TLS compression 

It either causes increased memory usage or exposes users
to the "CRIME attack" (CVE-2012-4929)
This commit is contained in:
Cristian Rodríguez 2012-11-12 16:41:58 +01:00 committed by Daniel Stenberg
parent 38ed72cd37
commit fa1ae0abcd
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
lib/ssluse.c
View File

@ -1501,6 +1501,10 @@ ossl_connect_step1(struct connectdata *conn,
ctx_options |= SSL_OP_NO_TICKET;
#endif
#ifdef SSL_OP_NO_COMPRESSION
ctx_options |= SSL_OP_NO_COMPRESSION;
#endif
#ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
/* mitigate CVE-2010-4180 */
ctx_options &= ~SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG;