1
$\begingroup$

https://news.ycombinator.com/item?id=19111707

https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/february/downgrade-attack-on-tls-1.3-and-vulnerabilities-in-major-tls-libraries/

No one knows that LibreSSL is affected by CVE-2018-12404, CVE-2018-19608, CVE-2018-16868, CVE-2018-16869, and CVE-2018-16870 or not.

Does anybody has any info about it?

Improve this question
$\endgroup$
3
  • $\begingroup$ The authors didn't test it. Actually as pointed out Gilles in the comments of this answer surely the first mitigation should be keeping your system up-to-date? Therefore if you don't support TLS 1.2 you are safe. $\endgroup$
    – kelalaka
    Commented Feb 8, 2019 at 11:30
  • $\begingroup$ For editing: I've tried to change the links as title and link but both have the same title. Better use our site's question? $\endgroup$
    – kelalaka
    Commented Feb 8, 2019 at 11:32
  • 5
    $\begingroup$ You are referencing various CVE which are not related to a TLS 1.3 downgrade but your title only asks about TLS 1.3 downgrade. Please make clear what you actually want to know. As for what you ask in the title: LibreSSL is not affected by TLS 1.3 downgrade since it does not support TLS 1.3 yet. $\endgroup$
    – Steffen Ullrich
    Commented Feb 8, 2019 at 12:29

1 Answer 1

Reset to default
0
$\begingroup$

LibreSSL doesn't support TLS 1.3.

Improve this answer
$\endgroup$
1
  • $\begingroup$ hopefully this is the best answer :) $\endgroup$
    – cirka547
    Commented Feb 25, 2019 at 11:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.