(ITS#8543) CVE-2015-3276: incorrect multi-keyword mode cipherstring parsing

[he@NetBSD.org]

Full_Name: Havard Eidnes
Version: 2.4.44
OS: NetBSD
URL: 
Submission from: (NULL) (2001:700:1:0:eeb1:d7ff:fe59:fbaa)


Hi,

CVE-2015-3276 appears to be unfixed in 2.4.44, and from several
attempts at finding the bug reported in your mailing list archive
I came up empty.  So ...  The best I've found from this CVE is
RedHat's bugzilla entry at

https://bugzilla.redhat.com/show_bug.cgi?id=1238322

which contains a (suggested) patch.

Summarized:

   The openldap (for NSS) emulation of the openssl cipherstring parsing code
   incorrectly implements the multi-keyword mode.
   As a consequence anyone using a combination like:

      ECDH+SHA

   will not get the expected set of ciphers [...]

(I'm somewhat dismayed that this was apparently not reported upstream
earlier...)

Best regards,

- Håvard