From 4f570023bf81205e63571898a0cb345697b715d0 Mon Sep 17 00:00:00 2001 From: saturneric Date: Sat, 12 Sep 2026 20:17:32 +0200 Subject: fix(tls): enforce minimum TLS 1.2 protocol version - prevent negotiation of deprecated SSLv3 and TLS 1.0/1.1 - use the minimum protocol API on newer OpenSSL versions - provide legacy OpenSSL fallback through protocol disable options --- src/vmime/net/tls/openssl/TLSSession_OpenSSL.cpp | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'src') diff --git a/src/vmime/net/tls/openssl/TLSSession_OpenSSL.cpp b/src/vmime/net/tls/openssl/TLSSession_OpenSSL.cpp index 019341c7..2b8a85e0 100644 --- a/src/vmime/net/tls/openssl/TLSSession_OpenSSL.cpp +++ b/src/vmime/net/tls/openssl/TLSSession_OpenSSL.cpp @@ -65,6 +65,18 @@ TLSSession_OpenSSL::TLSSession_OpenSSL( m_sslctx = SSL_CTX_new(SSLv23_client_method()); SSL_CTX_set_options(m_sslctx, SSL_OP_ALL | SSL_OP_NO_SSLv2); + + // SSL_OP_NO_SSLv2 alone still leaves SSLv3 and TLS 1.0/1.1 reachable, so a + // permissive system OpenSSL configuration could negotiate a protocol that + // has been considered broken for years. Mail credentials travel over these + // sessions, so pin a floor of TLS 1.2 rather than inheriting whatever the + // host happens to allow. +#if defined(SSL_CTX_set_min_proto_version) || OPENSSL_VERSION_NUMBER >= 0x10100000L + SSL_CTX_set_min_proto_version(m_sslctx, TLS1_2_VERSION); +#else + SSL_CTX_set_options(m_sslctx, SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1); +#endif + SSL_CTX_set_mode(m_sslctx, SSL_MODE_AUTO_RETRY); SSL_CTX_set_cipher_list(m_sslctx, m_props->getCipherSuite().c_str()); SSL_CTX_set_session_cache_mode(m_sslctx, SSL_SESS_CACHE_OFF); -- cgit