net/third_party/nss/patches/dh1024.patch

   1 diff --git a/ssl/ssl3con.c b/ssl/ssl3con.c
   2 index a67a9d1..02b0dda 100644
   3 --- a/ssl/ssl3con.c
   4 +++ b/ssl/ssl3con.c
   5 @@ -6964,7 +6964,8 @@ ssl3_HandleServerKeyExchange(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
   6         if (rv != SECSuccess) {
   7             goto loser;         /* malformed. */
   8         }
   9 -       if (dh_p.len < 512/8) {
  10 +       if (dh_p.len < 1024/8 ||
  11 +           (dh_p.len == 1024/8 && (dh_p.data[0] & 0x80) == 0)) {
  12             errCode = SSL_ERROR_WEAK_SERVER_EPHEMERAL_DH_KEY;
  13             goto alert_loser;
  14         }