From 1c0b6a42930331b46d331b7e4403e887343f8624 Mon Sep 17 00:00:00 2001 From: Adrien Destugues Date: Wed, 15 Oct 2014 16:17:09 +0200 Subject: [PATCH] SecureSocket: disable SSL versions 2 and 3 There are known vulnerabilities in those. Everyone should be using TLS by now. --- src/kits/network/libnetapi/SecureSocket.cpp | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/kits/network/libnetapi/SecureSocket.cpp b/src/kits/network/libnetapi/SecureSocket.cpp index 9373026923..a97bcf1ae3 100644 --- a/src/kits/network/libnetapi/SecureSocket.cpp +++ b/src/kits/network/libnetapi/SecureSocket.cpp @@ -95,6 +95,9 @@ BSecureSocket::Private::CreateContext() { sContext = SSL_CTX_new(SSLv23_method()); + // Disable legacy protocols. They have known vulnerabilities. + SSL_CTX_set_options(sContext, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3); + // Setup certificate verification BPath certificateStore; find_directory(B_SYSTEM_DATA_DIRECTORY, &certificateStore);