X-Git-Url: https://git.openssl.org/gitweb/?p=openssl.git;a=blobdiff_plain;f=ssl%2Fs3_srvr.c;h=c41eb8bdfaf7c855b6dc929d36729393ab471637;hp=49751a00487eaa72e0a4de2bf055016148f68e6f;hb=88f2a4cf9ced521e2c2874a1c32af0eeaa027f40;hpb=9d0397e9779524745018d03a8f938905898dfffb

diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c
index 49751a0048..c41eb8bdfa 100644
--- a/ssl/s3_srvr.c
+++ b/ssl/s3_srvr.c
@@ -1019,6 +1019,10 @@ int ssl3_get_client_hello(SSL *s)
 				break;
 				}
 			}
+/* Disabled because it can be used in a ciphersuite downgrade
+ * attack: CVE-2010-4180.
+ */
+#if 0
 		if (j == 0 && (s->options & SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG) && (sk_SSL_CIPHER_num(ciphers) == 1))
 			{
 			/* Special case as client bug workaround: the previously used cipher may
@@ -1033,6 +1037,7 @@ int ssl3_get_client_hello(SSL *s)
 				j = 1;
 				}
 			}
+#endif
 		if (j == 0)
 			{
 			/* we need to have the cipher in the cipher