After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 722755 - Remove insecure ciphers or give end users ability to disable
Remove insecure ciphers or give end users ability to disable
Status: RESOLVED NOTGNOME
Product: libsoup
Classification: Core
Component: HTTP Transport
2.44.x
Other Linux
: Normal normal
: ---
Assigned To: libsoup-maint@gnome.bugs
libsoup-maint@gnome.bugs
: 730477 (view as bug list)
Depends on:
Blocks:
 
 
Reported: 2014-01-22 06:36 UTC by Seth
Modified: 2014-05-26 15:33 UTC
See Also:
GNOME target: ---
GNOME version: ---


Description Seth 2014-01-22 06:36:42 UTC 
Visiting https://howsmyssl.com with dwb/lipsoup earns a "Bad" rating due to the presence of the insecure cipher suite TLS_DHE_DSS_WITH_RC4_128_SHA.

Can this cipher suite please be removed from lipsoup, or at the very least give users an easy way to disable it without having to edit source and recompile?

Environment: Archlinux x64 | dwb 2013.03.30-2 | libsoup 2.44.2-1
Comment 1 Dan Winship 2014-01-22 16:13:39 UTC 
We don't override gnutls's security decisions; they know more about security than we do. If you think that should be removed from the defaults, file a bug with gnutls.

In the meantime, you can override the defaults by setting "G_TLS_GNUTLS_PRIORITY=NORMAL:%COMPAT:-ARCFOUR-128" in your environment.
Comment 2 Seth 2014-01-23 23:20:25 UTC 
OK, thanks for the quick response and environment setting workaround. I'll open up a ticked with gnutls.
Comment 3 Michael Catanzaro 2014-05-21 01:44:54 UTC 
*** Bug 730477 has been marked as a duplicate of this bug. ***
Comment 4 Michael Catanzaro 2014-05-21 01:48:11 UTC 
Hi Seth, since this doesn't seem to have been fixed yet, could you post a link to the GnuTLS bug you created? Thanks.
Comment 5 Seth 2014-05-21 08:55:15 UTC 
Actually I forgot to file a bug report with GnuTLS so thanks for updating this issue and reminding me to do so.

Here's the link: https://savannah.gnu.org/support/index.php?108577
Comment 6 Michael Catanzaro 2014-05-21 14:47:54 UTC 
I'm having trouble registering an account on Savannah, or I would respond there, but RC4-128 is not the problem since howsmyssl is fine with both TLS_RSA_WITH_RC4_128_SHA and TLS_RSA_WITH_RC4_128_MD5 -- it's only TLS_DHE_DSS_WITH_RC4_128_SHA that they consider problematic.
Comment 7 Michael Catanzaro 2014-05-26 15:33:02 UTC 
Turns out this is a bug with howsmyssl.com: https://github.com/jmhodges/howsmyssl/issues/35