freeipa

#8000 [ipa-4-6] Restrict cipher lists used by openssl connections
Closed: fixed by abbra. Opened by frenaud.

Closed: fixed
Reopen Issue

The ipa-4-6 branch does not use the system-wide crypto in ipalib/util.py::create_https_connection(). The list of ciphers used is "HIGH:!aNULL:!eNULL:!MD5:!RC4:!3DES:!PSK:!SRP:!aDSS" and allows ciphers with weak algorithms.
It would be better to use 'HIGH:!aNULL:!eNULL:!MD5:!RC4:!3DES:!PSK:!SRP:!kECDH:!kDH'.
(The create_https_connection method is used for communications with dogtag or from the IPA CLI to IPA server.)

Note: the modification does not apply to ipa-4-7 and master branches as they are using system-wide crypto policies.

Metadata Update from @frenaud:
- Issue assigned to frenaud

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1727304

Issue linked to Bugzilla: Bug 1727304

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/3373

ipa-4-6:

  • 91641ac1ad5053487557b3b5a78f54fa157bfb38 Update the ciphers list

Metadata Update from @abbra:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
https://github.com/freeipa/freeipa/pull/3373
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.