[exim-dev] [Bug 2954] New: tls_eccurve (>= OpenSSL 3.0.0) d…

Startseite
Nachricht löschen
Nachricht beantworten
Autor: admin
Datum:  
To: exim-dev
Betreff: [exim-dev] [Bug 2954] New: tls_eccurve (>= OpenSSL 3.0.0) dysfunctional
https://bugs.exim.org/show_bug.cgi?id=2954

            Bug ID: 2954
           Summary: tls_eccurve (>= OpenSSL 3.0.0) dysfunctional
           Product: Exim
           Version: 4.96
          Hardware: x86-64
                OS: Linux
            Status: NEW
          Severity: security
          Priority: medium
         Component: TLS
          Assignee: jgh146exb@???
          Reporter: help@???
                CC: exim-dev@???


It is impossible to set a custom tls_eccurve if Exim is compiled against
OpenSSL >= 3.0.0 due to a parenthesis error: The value of SSL_CTX_set1_groups
rather than the comparison against 0 is assigned to rv, which subsequently
fails at "return !rv;"

https://github.com/Exim/exim/pull/89

Undefined it is secure. If however tls_eccurve is defined with OpenSSL >=
3.0.0, encryption initialization fails and mails could potentially be delivered
unencrypted, which is why I classified this bug with "Security" in severity.

--
You are receiving this mail because:
You are on the CC list for the bug.