Project

General

Profile

Actions
Copy link

Bug #2476

closed

Vunerable to CRIME SSL attack

Added by GDR about 12 years ago. Updated about 12 years ago.

Status:
Invalid
Priority:
Normal
Category:
-
Target version:
-
ASK QUESTIONS IN Forums:

Description

I've tested my instance of lighttpd 1.4.32 with this tool: https://www.ssllabs.com/ssltest/

The result of the test was that it's vunerable to CRIME attack against SSL. I've done extensive search in the internet, including lighttpd forums and issues, and haven't found a mention of CRIME attack.

Can this be fixed as a configuration change or does code need to be chagned?

Actions
Copy link
 #2

Updated by stbuehler about 12 years ago

  • Status changed from New to Invalid

You need to compile against a recent version of openssl (>= 1.0.0 probably); our source tries to use SSL_OP_NO_COMPRESSION to disable compression.

Our lighttpd2 build are from build.opensuse.org, which only supports debian stable (testing moving to fast usually).

We did not apply the ugly workaround by calling sk_SSL_COMP_zero(SSL_COMP_get_compression_methods()); (but the debian maintainers just applied this in debian stable - which is fine, because they won't have to maintain that patch for long; the next debian release has a recent enough openssl version)

Actions
Copy link
 #3

Updated by GDR about 12 years ago

OK, thank you. Hopefuly this issue will be visible in search engines so others will know.

Actions
Copy link

Also available in: Atom