The CRIME (Compression Ratio Info-leak Made Easy) attack is a vulnerability in the SSL compression. The attack against secret web cookies sent over compressed HTTPS or SPDY connections leaves cookie data vulnerable to session hijacking.

Table of contents
  1. SSL CRIME Security Assessment
  2. SSL CRIME Vulnerability Information
  3. GHow to Prevent SSL CRIME

SSL CRIME Security Assessment

Security Assessment Prevent SSL CRIME

CVSS Vector: AV:N/AC:H/AU:N/C:P/I:N/A:N

SSL CRIME Vulnerability Information

The CRIME (Compression Ratio Info-leak Made Easy) attack is a vulnerability in the SSL compression. The attack against secret web cookies sent over compressed HTTPS or SPDY connections leaves cookie data vulnerable to session hijacking.

GHow to Prevent SSL CRIME

To prevent the CRIME attack, disable SSL compression.

Apache

Using the standard settings, CRIME is only a problem for Apache version 2.4.3. To disable SSL compression, define the following directive in your SSL settings (usually /etc/apache2/mods-enabled/ssl.confor /etc/letsencrypt/options-ssl-apache.conf when using Let’s Encrypt). Also, strongly think of upgrading Apache to the latest version.

SSLCompression off

Nginx

Nginx is vulnerable for CRIME in older versions, which have SSL compression enabled. Please update to a recent version of Nginx and OpenSSL. The following versions are known to prevent the vulnerability:

  • 1.0.9 (if OpenSSL 1.0.0+ used)
  • 1.1.6 (if OpenSSL 1.0.0+ used)
  • 1.2.2
  • 1.3.2

See if Your Web App or API Has Security Vulnerabilities

SCAN FOR FREE NOW