Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1166567 - curl: Disable out-of-protocol fallback to SSL 3.0
Summary: curl: Disable out-of-protocol fallback to SSL 3.0
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: curl
Version: 19
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Kamil Dudka
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: 1154060
TreeView+ depends on / blocked
 
Reported: 2014-11-21 09:13 UTC by Kamil Dudka
Modified: 2015-01-03 18:59 UTC (History)
6 users (show)

Fixed In Version: curl-7.29.0-27.fc19
Doc Type: Bug Fix
Doc Text:
Clone Of: 1154060
Environment:
Last Closed: 2014-12-01 18:56:40 UTC
Type: Bug
Embargoed:

Attachments (Terms of Use)

Description Kamil Dudka 2014-11-21 09:13:34 UTC 
+++ This bug was initially created as a clone of Bug #1154060 +++

+++ This bug was initially created as a clone of Bug #1154059 +++

We should disable the retry-with-SSL-3.0 behavior in curl because it can be trivially triggered by an on-path attacker to cause a protocol downgrade, and SSL 3.0 has several known weaknesses.  This curl behavior is quite surprising because it is restricted to the NSS backend, and other systems which use the OpenSSL or GNUTLS backend do not share this behavior.

At this stage, it is best to leave SSL 3.0 enabled.  (The in-protocol version negotiation has not been broken, sosome TLS version will be used automatically if supported by the server.)

This might reintroduce bug 525496 and bug 527771, so a system-wide knob to re-enable the SSL 3.0 fallback might be necessary.  Perhaps the existence of a file like /etc/sysconfig/curl/enable-ssl-fallback could re-enable the old behavior.

--- Additional comment from Kamil Dudka on 2014-10-29 15:26:08 CET ---

The code in question has been removed from upstream libcurl:

https://github.com/bagder/curl/compare/07048941a4...276741af4d
Comment 1 Fedora Update System 2014-11-21 16:43:03 UTC 
curl-7.37.0-10.fc21 has been submitted as an update for Fedora 21.
https://admin.fedoraproject.org/updates/curl-7.37.0-10.fc21
Comment 2 Fedora Update System 2014-11-24 14:34:08 UTC 
curl-7.29.0-26.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/curl-7.29.0-26.fc19
Comment 3 Fedora Update System 2014-11-24 14:34:20 UTC 
curl-7.32.0-16.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/curl-7.32.0-16.fc20
Comment 4 Fedora Update System 2014-11-25 15:28:02 UTC 
Package curl-7.32.0-16.fc20:
* should fix your issue,
* was pushed to the Fedora 20 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing curl-7.32.0-16.fc20'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2014-15706/curl-7.32.0-16.fc20
then log in and leave karma (feedback).
Comment 5 Fedora Update System 2014-12-01 18:56:40 UTC 
curl-7.32.0-16.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Fedora Update System 2014-12-10 16:11:05 UTC 
curl-7.37.0-11.fc21 has been submitted as an update for Fedora 21.
https://admin.fedoraproject.org/updates/curl-7.37.0-11.fc21
Comment 7 Fedora Update System 2014-12-10 16:12:21 UTC 
curl-7.32.0-17.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/curl-7.32.0-17.fc20
Comment 8 Fedora Update System 2014-12-10 16:12:33 UTC 
curl-7.29.0-27.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/curl-7.29.0-27.fc19
Comment 9 Fedora Update System 2014-12-12 04:20:15 UTC 
curl-7.37.0-10.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 10 Fedora Update System 2014-12-13 09:46:30 UTC 
curl-7.32.0-17.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 11 Fedora Update System 2014-12-15 04:28:11 UTC 
curl-7.37.0-11.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 12 Fedora Update System 2015-01-03 18:59:36 UTC 
curl-7.29.0-27.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.
Note You need to log in before you can comment on or make changes to this bug.