Security fix for CVE-2010-4180 as mentioned in http://www.openssl.org/news/secadv_20101202.txt.

where clients could modify the stored session
cache ciphersuite and in some cases even downgrade the suite to weaker ones.

This code is not enabled by default.

ok djm@

1 files changed, 5 insertions, 0 deletions

diff --git a/src/lib/libssl/s3_srvr.c b/src/lib/libssl/s3_srvr.c
index 92f73b6681..61ee0a3e42 100644
--- a/src/lib/libssl/s3_srvr.c
+++ b/src/lib/libssl/s3_srvr.c
@@ -985,6 +985,10 @@ int ssl3_get_client_hello(SSL *s)
                                 break;
                                 }
                         }
+/* Disabled because it can be used in a ciphersuite downgrade
+ * attack: CVE-2010-4180.
+ */
+#if 0
                 if (j == 0 && (s->options & SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG) && (sk_SSL_CIPHER_num(ciphers) == 1))
                         {
                         /* Special case as client bug workaround: the previously used cipher may
@@ -999,6 +1003,7 @@ int ssl3_get_client_hello(SSL *s)
                                 j = 1;
                                 }
                         }
+#endif
                 if (j == 0)
                         {
                         /* we need to have the cipher in the cipher