From cd8ce13c29fb03714d90c4e9599b77aa1faa1a80 Mon Sep 17 00:00:00 2001 From: Renato Botelho Date: Wed, 11 Mar 2015 14:09:22 -0300 Subject: [PATCH] Explicit disable ssl.use-compression on lighty config. It should fix #4230 --- etc/inc/system.inc | 3 +++ 1 file changed, 3 insertions(+) diff --git a/etc/inc/system.inc b/etc/inc/system.inc index 06e7bbe7c1..e90a90d6af 100644 --- a/etc/inc/system.inc +++ b/etc/inc/system.inc @@ -1344,6 +1344,9 @@ EOD; // where ssl.cipher-list is set, this is automatically enabled, but set it explicitly anyway. $lighty_config .= "ssl.honor-cipher-order = \"enable\"\n"; + // Explicit disable compression to mitigate CRIME attack + $lighty_config .= "ssl.use-compression = \"disable\"\n"; + $lighty_config .= "ssl.cipher-list = \"AES128+EECDH:AES256+EECDH:AES128+EDH:AES256+EDH:AES128-SHA:AES256-SHA:!aNULL:!eNULL:!DSS\"\n"; if(!(empty($ca) || (strlen(trim($ca)) == 0)))