openssl removed ssl2/3 and broke cURL because curl uses openssl instead of libssl
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
curl (Ubuntu) |
New
|
Undecided
|
Unassigned |
Bug Description
cURL supports a -ssl3 option (and rightly so), but openssl removed it prematurely (see https:/
torsocks curl --insecure --ssl-allow-beast -ssl3 -vvI https:/
* Trying 127.42.42.0:110...
* Connected to xhfheq5i37waj6q
* OpenSSL was built without SSLv3 support
* Closing connection 0
Is it possible that curl's check for ssl3 is flawed? I say that because both curl and fetchmail are dependant on the same libssl pkg, and yet fetchmail can still do ssl3 but curl can't. Neither curl nor fetchmail names "openssl" as a dependency. So curl perhaps should not look to the openssl package to detect ssl3 capability.
SSL3 is still useful for onion sites, so curl should do the necessary to retain that capability.