Ted Unangst wrote:
> The patch below includes the fix for CVE-2015-0204 as well as some other "low
> severity" fixes for similar downgrade issues relating to ECDHE.
Heads up. This patch contains a not quite backwards compatible change. We
removed support for 512 bit DH exchange as part of the diff, but some programs
such as nrpe use them.
Code such as the following:
/* use anonymous DH ciphers */
SSL_CTX_set_cipher_list(ctx,"ADH");
dh=get_dh512();
SSL_CTX_set_tmp_dh(ctx,dh);
DH_free(dh);
Should be changed to something more like the following:
/* use anonymous ciphers */
SSL_CTX_set_cipher_list(ctx,"aNULL");
SSL_CTX_set_dh_auto(ctx, 1);
SSL_CTX_set_ecdh_auto(ctx, 1);
Our rule for stable is to not break things, but we hadn't realized 512 bit DH
(terribly weak) would actually be in use by "production" software. At this
time, having already released the patch, we'll leave it out there. The diff
below should revert the change, however, if you find yourself in a bind.
Thanks to henning@ for spotting the problem, and guenther@ for identifying the
cause.
Index: s3_clnt.c
===================================================================
RCS file: /cvs/src/lib/libssl/src/ssl/s3_clnt.c,v
retrieving revision 1.108
retrieving revision 1.107
diff -u -p -r1.108 -r1.107
--- s3_clnt.c 8 Mar 2015 16:48:47 -0000 1.108
+++ s3_clnt.c 7 Feb 2015 05:46:01 -0000 1.107
@@ -1267,17 +1267,6 @@ ssl3_get_key_exchange(SSL *s)
}
p += i;
n -= param_len;
-
- /*
- * Check the strength of the DH key just constructed.
- * Discard keys weaker than 1024 bits.
- */
-
- if (DH_size(dh) < 1024 / 8) {
- SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,
- SSL_R_BAD_DH_P_LENGTH);
- goto err;
- }
if (alg_a & SSL_aRSA)
pkey = X509_get_pubkey(
