]> CyberLeo.Net >> Repos - FreeBSD/FreeBSD.git/commit
An additional fix for the openssl Weak DH remediation:
authorgshapiro <gshapiro@FreeBSD.org>
Tue, 23 Jun 2015 04:33:54 +0000 (04:33 +0000)
committergshapiro <gshapiro@FreeBSD.org>
Tue, 23 Jun 2015 04:33:54 +0000 (04:33 +0000)
commit2fe739732c0931e2b380a0954eed45eab9ac0278
tree8d29bf12cf9bece5bb38645412991e48ee661631
parent2c76978d5ae6aecfe54cbba43cb30b3f521c37ef
An additional fix for the openssl Weak DH remediation:

The import of openssl to address the FreeBSD-SA-15:10.openssl security
advisory includes a change which rejects handshakes with DH parameters
below 768 bits.  sendmail releases prior to 8.15.2 (not yet released),
defaulted to a 512 bit DH parameter setting for client connections.

The first fix committed last week changed the default to 1024 bits.

This commit fixes the case where the DHParameters option is set to a
file which doesn't exist, which is the case on newer versions of
FreeBSD which enable STARTTLS by default by auto-creating TLS
certificates.

MFC after: 2 days
contrib/sendmail/src/sendmail.h