Skip to content

fix crash when logging TLS 1.3 properties (CVE-2017-10872) #1543

@kazuho

Description

@kazuho

The server segfaults when trying to emit the bits of a TLS 1.3 cipher-suite being used to the access-log (by specifying %{ssl.cipher-bits}x).

To avoid the issue, users are advised to upgrade to version 2.2.4 or to disable the use of TLS 1.3 (by setting the maximum-version to 1.2).

The issue was reported by @herumi in #1465.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions