search

cherrypy / cherrypy

CherryPy is a pythonic, object-oriented HTTP framework. https://cherrypy.dev
https://docs.cherrypy.dev
BSD 3-Clause "New" or "Revised" License
1.8k stars 357 forks source link

Provide a default secure TLS Cipher list #1997

Closed gaby closed 11 months ago

gaby commented 12 months ago

By default CherryPy is listening for unsecured ciphers that leave instances exposed to several CVE's. Using the Mozilla TLS configurator I was able to generate the following list which could be used as the default cipher list for CherryPy. 

cherrypy_cfg["server.ssl_ciphers"] = (
    "ECDHE-ECDSA-AES128-GCM-SHA256:"
    "ECDHE-RSA-AES128-GCM-SHA256:"
    "ECDHE-ECDSA-AES256-GCM-SHA384:"
    "ECDHE-RSA-AES256-GCM-SHA384:"
    "ECDHE-ECDSA-CHACHA20-POLY1305:"
    "ECDHE-RSA-CHACHA20-POLY1305:"
    "DHE-RSA-AES128-GCM-SHA256:"
    "DHE-RSA-AES256-GCM-SHA384:"
    "DHE-RSA-CHACHA20-POLY1305"
)

Using this configuration CherryPy should only listen for secure TLSv1.2 and TLSv1.3 connections.