Skip to content

Flag absence of extended master secret extension#2982

Merged
drwetter merged 3 commits into3.3devfrom
feature_2806
Jan 15, 2026
Merged

Flag absence of extended master secret extension#2982
drwetter merged 3 commits into3.3devfrom
feature_2806

Conversation

@drwetter
Copy link
Collaborator

This PR fixes #2806 and implements a feature request. TLS >=1.2 MUST support support the extended_master_secret extension to address an attack resulting from TLS session parameters not being properly authenticated in a Triple Handshake scenario (https://ieeexplore.ieee.org/document/6956559).

Only if the extension is missing there will be a medium severity level finding. JSON output will be generated in any case.

Also in determine_tls_extensions() some documentation about TLS extensions to be send were added.

What is your pull request about?

  • Bug fix
  • Improvement
  • New feature (adds functionality)
  • Breaking change (bug fix, feature or improvement that would cause existing functionality to not work as expected)
  • Typo fix
  • Documentation update
  • Update of other files

If it's a code change please check the boxes which are applicable

  • For the main program: My edits contain no tabs, indentation is five spaces and any line endings do not contain any blank chars
  • I've read CONTRIBUTING.md and Coding_Convention.md
  • I have tested this fix or improvement against >=2 hosts and I couldn't spot a problem
  • I have tested this new feature against >=2 hosts which show this feature and >=2 host which does not (in order to avoid side effects) . I couldn't spot a problem
  • For the new feature I have made corresponding changes to the documentation and / or to help()
  • If it's a bigger change: I added myself to CREDITS.md (alphabetical order) and the change to CHANGELOG.md

This PR fixes #2806 and implements a feature request. TLS >=1.2 MUST support
support the extended_master_secret extension to address an attack resulting
from TLS session parameters not being properly authenticated in a Triple
Handshake scanario (https://ieeexplore.ieee.org/document/6956559).

Only if the extension is missing there will be a medium severity level
finding. JSON output will be generated in any case.

Also in determine_tls_extensions() some documenation about tls extensions
to be send were added.
@drwetter drwetter merged commit 79db276 into 3.3dev Jan 15, 2026
5 checks passed
@drwetter drwetter deleted the feature_2806 branch January 15, 2026 14:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Feature request] flag absence of extended master secret extension

1 participant