1745065 - Add additional ciphers to DisabledCiphers policy

Status: RESOLVED FIXED

(Firefox :: Enterprise Policies, enhancement, P3)

Description

[Mike Kaply [:mkaply]]

The list of cipher suites that can be blocked seems out-of-date. Specifically, it does not include the option to block these two weak ciphers that Firefox appears to still support.

TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a) WEAK 256
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009) WEAK 128

Also, we should keep an eye on this for future releasees.

Comment 1

[Mike Kaply [:mkaply]]

Attachment: Bug 1745065 - Add support for managing more ciphers in policy. r?keeler

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/37c16eb578cd
Add support for managing more ciphers in policy. r=keeler

Comment 3

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/37c16eb578cd

Comment 4

[Mike Kaply [:mkaply]]

Attachment: Patch for ESR

Comment 5

[Mike Kaply [:mkaply]]

Comment on attachment 9259948 [details] [diff] [review]
Patch for ESR

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: Policy only, match Firefox 96
• User impact if declined: Unable to disable certain siphers
• Fix Landed on Version: 97
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Policy only

Comment 6

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9259948 [details] [diff] [review]
Patch for ESR

Approved for 91.6esr.

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr91/rev/c652dc1b410c