diff options
| author | Colin Percival <cperciva@FreeBSD.org> | 2005-10-11 11:53:03 +0000 |
|---|---|---|
| committer | Colin Percival <cperciva@FreeBSD.org> | 2005-10-11 11:53:03 +0000 |
| commit | 2e78fee2396410636caecd5addac787230a1efc2 (patch) | |
| tree | 3d0abfb131498adf84009eaeee33a8015e24de38 /crypto | |
| parent | d46bcf33415389d35b078df182daea295fdde2e0 (diff) | |
Correct a man-in-the-middle SSL version rollback vulnerability.
Security: FreeBSD-SA-05:21.openssl
Approved by: re@ (scottl)
Notes
Notes:
svn path=/stable/6/; revision=151237
Diffstat (limited to 'crypto')
| -rw-r--r-- | crypto/openssl/crypto/opensslv.h | 4 | ||||
| -rw-r--r-- | crypto/openssl/ssl/s23_srvr.c | 7 |
2 files changed, 3 insertions, 8 deletions
diff --git a/crypto/openssl/crypto/opensslv.h b/crypto/openssl/crypto/opensslv.h index acb4584869bc..d4cf38eecc29 100644 --- a/crypto/openssl/crypto/opensslv.h +++ b/crypto/openssl/crypto/opensslv.h @@ -27,9 +27,9 @@ */ #define OPENSSL_VERSION_NUMBER 0x0090705FL #ifdef OPENSSL_FIPS -#define OPENSSL_VERSION_TEXT "OpenSSL 0.9.7e-fips 25 Oct 2004" +#define OPENSSL_VERSION_TEXT "OpenSSL 0.9.7e-fips-p1 25 Oct 2004" #else -#define OPENSSL_VERSION_TEXT "OpenSSL 0.9.7e 25 Oct 2004" +#define OPENSSL_VERSION_TEXT "OpenSSL 0.9.7e-p1 25 Oct 2004" #endif #define OPENSSL_VERSION_PTEXT " part of " OPENSSL_VERSION_TEXT diff --git a/crypto/openssl/ssl/s23_srvr.c b/crypto/openssl/ssl/s23_srvr.c index c5404ca0bcd4..5139477eb780 100644 --- a/crypto/openssl/ssl/s23_srvr.c +++ b/crypto/openssl/ssl/s23_srvr.c @@ -268,9 +268,6 @@ int ssl23_get_client_hello(SSL *s) int n=0,j; int type=0; int v[2]; -#ifndef OPENSSL_NO_RSA - int use_sslv2_strong=0; -#endif if (s->state == SSL23_ST_SR_CLNT_HELLO_A) { @@ -519,9 +516,7 @@ int ssl23_get_client_hello(SSL *s) } s->state=SSL2_ST_GET_CLIENT_HELLO_A; - if ((s->options & SSL_OP_MSIE_SSLV2_RSA_PADDING) || - use_sslv2_strong || - (s->options & SSL_OP_NO_TLSv1 && s->options & SSL_OP_NO_SSLv3)) + if (s->options & SSL_OP_NO_TLSv1 && s->options & SSL_OP_NO_SSLv3) s->s2->ssl2_rollback=0; else /* reject SSL 2.0 session if client supports SSL 3.0 or TLS 1.0 |