mirror/curl
2
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2025-01-30 14:22:33 +08:00
Code Issues Packages Projects Releases Wiki Activity

curl: ignore options asking for SSLv2 or SSLv3

Browse Source 
Instead output a warning about it and continue with the defaults.

These SSL versions are typically not supported by the TLS libraries since a
long time back already since they are inherently insecure and broken. Asking
for them to be used will just cause an error to be returned slightly later.

In the unlikely event that a user's TLS library actually still supports these
protocol versions, this change might make the request a little less insecure.

Closes #6772
This commit is contained in:
Daniel Stenberg 2021-03-22 11:55:27 +01:00
parent 6fc805d0c1
commit cf65d4237e
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
3 changed files with 7 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
docs/cmdline-opts/sslv2.d
View File

@ -9,6 +9,5 @@ See-also: http1.1 http2
Help: Use SSLv2
Category: tls
---
Forces curl to use SSL version 2 when negotiating with a remote SSL
server. Sometimes curl is built without SSLv2 support. SSLv2 is widely
considered insecure (see RFC 6176).
This option previously asked curl to use SSLv2, but starting in curl 7.77.0 this
instruction is ignored. SSLv2 is widely considered insecure (see RFC 6176).

6
docs/cmdline-opts/sslv3.d
View File

@ -9,6 +9,6 @@ See-also: http1.1 http2
Help: Use SSLv3
Category: tls
---
Forces curl to use SSL version 3 when negotiating with a remote SSL
server. Sometimes curl is built without SSLv3 support. SSLv3 is widely
considered insecure (see RFC 7568).
This option previously asked curl to use SSLv3, but starting in curl 7.77.0
this instruction is ignored. SSLv3 is widely considered insecure (see RFC
7568).

4
src/tool_getparam.c
View File

@ -1306,11 +1306,11 @@ ParameterError getparameter(const char *flag, /* f or -long-flag */
break;
case '2':
/* SSL version 2 */
config->ssl_version = CURL_SSLVERSION_SSLv2;
warnf(global, "Ignores instruction to use SSLv2\n");
break;
case '3':
/* SSL version 3 */
config->ssl_version = CURL_SSLVERSION_SSLv3;
warnf(global, "Ignores instruction to use SSLv3\n");
break;
case '4':
/* IPv4 */