You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
If you discover a potential security issue in s2n we ask that you notify
AWS Security via our vulnerability reporting page. Please do not create a public github issue.
Add a new integ test that checks we still correctly do this correctly. In order to do this, we will need to edit our Openssl1.0.2 script and configure it to enable sslv2 (remove the -no-ssl2 flag and add the enable-ssl2 flag). Then the openssl s_client will recognize the -ssl2 command flag and send a SSLv2 client hello.
The text was updated successfully, but these errors were encountered:
Security issue notifications
If you discover a potential security issue in s2n we ask that you notify
AWS Security via our vulnerability reporting page. Please do not create a public github issue.
Problem:
An s2n-tls server will negotiate a TLS1.2 if it encounters an SSLv2-formatted client hello. This behavior used to be integ tested, but apparently that test was lost when we moved from v1 -> v2.
Solution:
Add a new integ test that checks we still correctly do this correctly. In order to do this, we will need to edit our Openssl1.0.2 script and configure it to enable sslv2 (remove the
-no-ssl2
flag and add theenable-ssl2
flag). Then the openssl s_client will recognize the -ssl2 command flag and send a SSLv2 client hello.The text was updated successfully, but these errors were encountered: