Merge pull request #412

zeek · Jul 14, 2024 · aa81a91 · aa81a91
2 parents 2777023 + ca197cd
commit aa81a91
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 1 deletion.
diff --git a/CHANGES b/CHANGES
@@ -1,3 +1,7 @@
+2.8.0-dev.109 | 2024-07-14 11:04:26 +0200
+
+  * Enforce TLS version 1.2 as minimum when using SSL (Dominik Charousset, Corelight)
+
 2.8.0-dev.107 | 2024-07-14 08:39:15 +0200
 
   * Add more btests to replace "unit" tests (Dominik Charousset, Corelight)

diff --git a/VERSION b/VERSION
@@ -1 +1 @@
-2.8.0-dev.107
+2.8.0-dev.109
diff --git a/libbroker/broker/internal/connector.cc b/libbroker/broker/internal/connector.cc
@@ -261,6 +261,8 @@ ssl_context_from_cfg(const openssl_options_ptr& cfg) {
     if (SSL_CTX_set_cipher_list(ctx.get(), cipher) != 1)
       throw ssl_error("failed to set anonymous cipher");
   }
+  // Prohibit outdated and insecure protocols.
+  SSL_CTX_set_min_proto_version(ctx.get(), TLS1_2_VERSION);
   return ctx;
 }