[openssl-users] BEAST and SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
jonetsu at teksavvy.com
Wed Jul 22 12:12:24 UTC 2015
Our Nessus version 6.4.1 is detecting a BEAST vulnerability against OpenSSL 1.0.1e. The source code defines SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS as 0x00000800L and several tests are made for this value in the code. The CHANGES mentions though that this had some side effects, the option now being part of SSL_OP_ALL. It would look like, from the scan, that the fragments are not enabled by default, could it be ?
More information about the openssl-users