0
$\begingroup$

https://news.ycombinator.com/item?id=19111707

https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/february/downgrade-attack-on-tls-1.3-and-vulnerabilities-in-major-tls-libraries/

No one knows that LibreSSL is affected by CVE-2018-12404, CVE-2018-19608, CVE-2018-16868, CVE-2018-16869, and CVE-2018-16870 or not.

Does anybody has any info about it?

$\endgroup$
  • $\begingroup$ The authors didn't test it. Actually as pointed out Gilles in the comments of this answer surely the first mitigation should be keeping your system up-to-date? Therefore if you don't support TLS 1.2 you are safe. $\endgroup$ – kelalaka Feb 8 at 11:30
  • $\begingroup$ For editing: I've tried to change the links as title and link but both have the same title. Better use our site's question? $\endgroup$ – kelalaka Feb 8 at 11:32
  • 5
    $\begingroup$ You are referencing various CVE which are not related to a TLS 1.3 downgrade but your title only asks about TLS 1.3 downgrade. Please make clear what you actually want to know. As for what you ask in the title: LibreSSL is not affected by TLS 1.3 downgrade since it does not support TLS 1.3 yet. $\endgroup$ – Steffen Ullrich Feb 8 at 12:29
0
$\begingroup$

LibreSSL doesn't support TLS 1.3.

$\endgroup$
  • $\begingroup$ hopefully this is the best answer :) $\endgroup$ – cirka547 Feb 25 at 11:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.