20231080 problem in UTILITY/W3M s11-update
authorRich Burridge <rich.burridge@oracle.com>
Wed, 22 Apr 2015 09:13:05 -0700
branchs11-update
changeset 4166 f7c991485826
parent 4163 b088658aed2f
child 4167 207dfd0fbc6d
20231080 problem in UTILITY/W3M
components/w3m/patches/05-init-openssl.patch
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/components/w3m/patches/05-init-openssl.patch	Wed Apr 22 09:13:05 2015 -0700
@@ -0,0 +1,15 @@
+Disable SSLv2 and SSLv3 in w3m to "mitigate POODLE vulnerability".
+
+This change has been passed upstream.
+
+--- w3m-0.5.2/url.c.orig	2015-01-29 08:37:04.156739107 -0800
++++ w3m-0.5.2/url.c	2015-01-29 08:48:24.055383389 -0800
[email protected]@ -337,6 +337,8 @@
+ 		option |= SSL_OP_NO_TLSv1;
+ 	}
+ 	SSL_CTX_set_options(ssl_ctx, option);
++	/* Always disable SSLv2 & SSLv3 to "mitigate POODLE vulnerability". */
++	SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3);
+ #ifdef USE_SSL_VERIFY
+ 	/* derived from openssl-0.9.5/apps/s_{client,cb}.c */
+ #if 1				/* use SSL_get_verify_result() to verify cert */