nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-10 13:13:44 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add a changes file for bug4822

Browse Source
This commit is contained in:
Nick Mathewson 2012-01-04 21:17:52 -05:00
parent db78fe4589
commit 0a00678e56
1 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
changes/bug4822 Normal file
View File

@ -0,0 +1,13 @@
o Major security workaround:
- When building or running with any version of OpenSSL earlier
than 0.9.8s or 1.0.0f, disable SSLv3 support. These versions had
a bug (CVE-2011-4576) in which their block cipher padding
included uninitialized data, potentially leaking sensitive
information to any peer with whom they made a SSLv3
connection. Tor does not use SSL v3 by default, but a hostile
client or server could force an SSLv3 connection in order to
gain information that they shouldn't have been able to get. The
best solution here is to upgrade to OpenSSL 0.9.8s or 1.0.0f (or
later). But when building or running with a non-upgraded
OpenSSL, we should instead make sure that the bug can't happen
by disabling SSLv3 entirely.