Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

This is a vulnerability in socat's TLS support. It has nothing to do with OpenSSL (besides the fact that OpenSSL provided a footgun API by leaving it to application developers to supply DH parameters).


"Footgun API" - I like that!

Its an interesting challenge though, I wonder if the person who picked the constant the first time understood the ramifications of it being prime or not. And if they did, how hard they worked to validate its primality.


btw, they recommend checking custom params via DH_check() (https://wiki.openssl.org/index.php/Diffie-Hellman_parameters...) but, appparently, neither apache nor nginx do this...




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: