CVE-2010-4180 fix (from OpenSSL_1_0_0-stable)
diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c index 0c1df8c..b7287e5 100644 --- a/ssl/s3_clnt.c +++ b/ssl/s3_clnt.c
@@ -884,8 +884,11 @@ s->session->cipher_id = s->session->cipher->id; if (s->hit && (s->session->cipher_id != c->id)) { +/* Workaround is now obsolete */ +#if 0 if (!(s->options & SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG)) +#endif { al=SSL_AD_ILLEGAL_PARAMETER; SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED);