diff options
| author | Matthias Andree <matthias.andree@gmx.de> | 2012-04-06 21:31:53 +0200 |
|---|---|---|
| committer | Matthias Andree <matthias.andree@gmx.de> | 2012-05-03 08:13:13 +0200 |
| commit | 48809c5b9f6c9081f4031fa938dd63b060c18a4b (patch) | |
| tree | 3b454a5bcdaa175b2b8b2b3c455b9a3e7336e8af /fetchmail.man | |
| parent | e4ef077fdad22286502ae485b7b8f7ca88fd49dd (diff) | |
| download | fetchmail-48809c5b9f6c9081f4031fa938dd63b060c18a4b.tar.gz fetchmail-48809c5b9f6c9081f4031fa938dd63b060c18a4b.tar.bz2 fetchmail-48809c5b9f6c9081f4031fa938dd63b060c18a4b.zip | |
Fix CVE-2011-3389 by clearing SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS...
...from SSL options, unless FETCHMAIL_DISABLE_CBC_IV_COUNTERMEASURE
is a non-empty environment variable.
Suggested by Apple.
Diffstat (limited to 'fetchmail.man')
| -rw-r--r-- | fetchmail.man | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/fetchmail.man b/fetchmail.man index e953a5dd..974f5eac 100644 --- a/fetchmail.man +++ b/fetchmail.man @@ -2781,6 +2781,16 @@ then that name is used as the default local name. Otherwise session ID (this elaborate logic is designed to handle the case of multiple names per userid gracefully). +.IP \fBFETCHMAIL_DISABLE_CBC_IV_COUNTERMEASURE\fP +(since v6.3.22): +If this environment variable is set and not empty, fetchmail will disable +a countermeasure against an SSL CBC IV attack (by setting +SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS). This is a security risk, but may be +necessary for connecting to certain non-standards-conforming servers. +See fetchmail's NEWS file and fetchmail-SA-2012-01.txt for details. +Earlier fetchmail versions (v6.3.21 and older) used to disable this +countermeasure, but v6.3.22 no longer does that as a safety precaution. + .IP \fBFETCHMAIL_INCLUDE_DEFAULT_X509_CA_CERTS\fP (since v6.3.17): If this environment variable is set and not empty, fetchmail will always load |