Bug 1109115

Summary: Use the system crypto policy unless otherwise specified
Product: [Fedora] Fedora Reporter: Nikos Mavrogiannopoulos <nmavrogi>
Component: mod_gnutlsAssignee: Jiri Kastner <cz172638>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 21CC: cz172638, e, nmavrogi
Target Milestone: ---Keywords: Reopened
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: mod_gnutls-0.7-2.fc21 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-05-26 21:24:15 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1076390    

Description Nikos Mavrogiannopoulos 2014-06-13 09:36:09 UTC 
Please convert to use the system's crypto policy for SSL and TLS:
https://fedoraproject.org/wiki/Changes/CryptoPolicy#Scope

If this program is compiled against gnutls, change the default priority string to be "@SYSTEM" or to use gnutls_set_default_priority().

If this program is compiled against openssl, and there is no default cipher list specified, you don't need to modify it. Otherwise replace the default cipher list with "PROFILE=SYSTEM".

If this program obtains its cipher list (or priority) using a configuration file, please update the shipped configuration files with the appropriate string that sets the system policy.

In all cases please verify (as described in the URL above) that the application uses the system's crypto profiles.

Please contact me for any questions.
Comment 1 Nikos Mavrogiannopoulos 2014-07-04 10:57:29 UTC 
A quick reminder; this is a blocker for #1076390. if you have no resources to pursue that please contact me.
Comment 2 Erick Calder 2014-09-08 17:47:25 UTC 
why was this assigned to me?  I don't work on this stuff
Comment 3 Nikos Mavrogiannopoulos 2014-09-08 18:52:27 UTC 
You are the listed maintainer of the package. If you are not please orphan it.
Comment 4 Erick Calder 2014-09-09 01:35:21 UTC 
oh.  sadly I no longer have the resources needed to maintain this.  I also don't know how to orphan it
Comment 5 Nikos Mavrogiannopoulos 2014-09-09 06:52:37 UTC 
Please go to:
https://admin.fedoraproject.org/pkgdb/package/mod_gnutls/

login, and then press orphan package.
Comment 6 Jiri Kastner 2014-09-09 10:29:07 UTC 
please eric, can you to approve me as maintainer and contact person for this package?
instead of orphaning as i already have commit rights
Comment 7 Fedora Admin XMLRPC Client 2014-09-09 16:52:01 UTC 
This package has changed ownership in the Fedora Package Database.  Reassigning to the new owner of this component.
Comment 8 Erick Calder 2014-09-09 16:53:43 UTC 
I've left myself as an admin.  at some point I will have enough time to set up my RPM packaging environment again and will be happy to give this package some love
Comment 9 Jiri Kastner 2014-09-10 08:16:32 UTC 
i can take care of packaging part, can you help me with 'impementation part'?
is it problem of autotools configuration or is needed change in code?
Comment 10 Nikos Mavrogiannopoulos 2014-09-10 11:08:44 UTC 
For that change, the only thing needed is to put the "@SYSTEM" string in the GnuTLSPriorities of the default configuration file.
Comment 11 Jiri Kastner 2014-09-12 10:48:46 UTC 
this way?

#########

[indy@dhcp-27-216 mod_gnutls]$ cat mod_gnutls.conf
LoadModule gnutls_module modules/mod_gnutls.so

GnuTLSCache dbm "/var/cache/mod_gnutls"
GnuTLSCacheTimeout 300
GnuTLSPriorities "@SYSTEM"
Comment 12 Nikos Mavrogiannopoulos 2014-09-12 10:58:27 UTC 
That seems right.
Comment 13 Fedora Update System 2014-09-12 14:05:24 UTC 
mod_gnutls-0.5.10-13.el7 has been submitted as an update for Fedora EPEL 7.
https://admin.fedoraproject.org/updates/mod_gnutls-0.5.10-13.el7
Comment 14 Fedora Update System 2014-09-12 14:05:52 UTC 
mod_gnutls-0.5.10-13.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/mod_gnutls-0.5.10-13.fc19
Comment 15 Fedora Update System 2014-09-12 14:06:14 UTC 
mod_gnutls-0.5.10-13.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/mod_gnutls-0.5.10-13.fc20
Comment 16 Fedora Update System 2014-09-12 14:06:34 UTC 
mod_gnutls-0.5.10-13.fc21 has been submitted as an update for Fedora 21.
https://admin.fedoraproject.org/updates/mod_gnutls-0.5.10-13.fc21
Comment 17 Nikos Mavrogiannopoulos 2014-09-12 14:14:53 UTC 
I haven't checked the package, but please note that this is a fedora 21 only feature. The @SYSTEM will not work on any other system than Fedora 21 (or rawhide).
Comment 18 Fedora Update System 2014-09-12 17:47:06 UTC 
Package mod_gnutls-0.5.10-13.fc21:
* should fix your issue,
* was pushed to the Fedora 21 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing mod_gnutls-0.5.10-13.fc21'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2014-10766/mod_gnutls-0.5.10-13.fc21
then log in and leave karma (feedback).
Comment 19 Jiri Kastner 2014-09-18 09:57:06 UTC 
thanks, unpushed from epel7 and fedora 19, 20.

(In reply to Nikos Mavrogiannopoulos from comment #17)
> I haven't checked the package, but please note that this is a fedora 21 only
> feature. The @SYSTEM will not work on any other system than Fedora 21 (or
> rawhide).
Comment 20 Fedora Update System 2014-10-03 14:43:13 UTC 
mod_gnutls-0.5.10-14.el7 has been submitted as an update for Fedora EPEL 7.
https://admin.fedoraproject.org/updates/mod_gnutls-0.5.10-14.el7
Comment 21 Fedora Update System 2014-10-03 14:44:00 UTC 
mod_gnutls-0.5.10-14.fc21 has been submitted as an update for Fedora 21.
https://admin.fedoraproject.org/updates/mod_gnutls-0.5.10-14.fc21
Comment 22 Fedora Update System 2014-10-03 14:44:24 UTC 
mod_gnutls-0.5.10-14.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/mod_gnutls-0.5.10-14.fc20
Comment 23 Fedora Update System 2014-10-03 14:44:45 UTC 
mod_gnutls-0.5.10-14.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/mod_gnutls-0.5.10-14.fc19
Comment 24 Jiri Kastner 2014-10-03 15:35:05 UTC 
[root@jetson ~]# systemctl status httpd.service -l
● httpd.service - The Apache HTTP Server
   Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled)
   Active: failed (Result: exit-code) since Fri 2014-10-03 17:21:31 CEST; 4min 39s ago
  Process: 924 ExecStart=/usr/sbin/httpd $OPTIONS -DFOREGROUND (code=exited, status=1/FAILURE)
 Main PID: 924 (code=exited, status=1/FAILURE)

Oct 03 17:21:31 jetson httpd[924]: AH00526: Syntax error on line 5 of /etc/httpd/conf.d/mod_gnutls.conf:
Oct 03 17:21:31 jetson httpd[924]: GnuTLS: Syntax error parsing priorities string at: "@SYSTEM"
Oct 03 17:21:31 jetson systemd[1]: httpd.service: main process exited, code=exited, status=1/FAILURE
Oct 03 17:21:31 jetson systemd[1]: Failed to start The Apache HTTP Server.
Oct 03 17:21:31 jetson systemd[1]: Unit httpd.service entered failed state.
Comment 25 Jiri Kastner 2014-10-05 08:20:20 UTC 
checked on rawhide - same, @SYSTEM is not recognised
Comment 26 Nikos Mavrogiannopoulos 2014-10-06 08:31:30 UTC 
What is the output of:
$ gnutls-cli -l --priority @SYSTEM

in that system, I just tried it on a newly installed F21 and it lists the ciphersuites.
Comment 27 Jiri Kastner 2014-10-07 12:15:46 UTC 
########### f21 ################

[root@localhost ~]# systemctl status httpd.service -l
● httpd.service - The Apache HTTP Server
   Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled)
   Active: failed (Result: exit-code) since Tue 2014-10-07 14:11:24 CEST; 10s ago
  Process: 963 ExecStop=/bin/kill -WINCH ${MAINPID} (code=exited, status=1/FAILURE)
  Process: 961 ExecStart=/usr/sbin/httpd $OPTIONS -DFOREGROUND (code=exited, status=1/FAILURE)
 Main PID: 961 (code=exited, status=1/FAILURE)

Oct 07 14:11:24 localhost httpd[961]: AH00526: Syntax error on line 5 of /etc/httpd/conf.d/mod_gnutls.conf:
Oct 07 14:11:24 localhost httpd[961]: GnuTLS: Syntax error parsing priorities string at: "@SYSTEM"
Oct 07 14:11:24 localhost systemd[1]: httpd.service: main process exited, code=exited, status=1/FAILURE
Oct 07 14:11:24 localhost kill[963]: kill: cannot find process ""
Oct 07 14:11:24 localhost systemd[1]: httpd.service: control process exited, code=exited status=1
Oct 07 14:11:24 localhost systemd[1]: Failed to start The Apache HTTP Server.
Oct 07 14:11:24 localhost systemd[1]: Unit httpd.service entered failed state.
[root@localhost ~]# gnutls-cli -l --priority @SYSTEM
Cipher suites for @SYSTEM
TLS_ECDHE_RSA_AES_128_CBC_SHA1                          0xc0, 0x13      SSL3.0
TLS_ECDHE_RSA_AES_128_CBC_SHA256                        0xc0, 0x27      TLS1.0
TLS_ECDHE_RSA_CAMELLIA_128_CBC_SHA256                   0xc0, 0x76      TLS1.0
TLS_ECDHE_RSA_AES_256_CBC_SHA1                          0xc0, 0x14      SSL3.0
TLS_ECDHE_RSA_AES_256_CBC_SHA384                        0xc0, 0x28      TLS1.0
TLS_ECDHE_RSA_CAMELLIA_256_CBC_SHA384                   0xc0, 0x77      TLS1.0
TLS_ECDHE_RSA_3DES_EDE_CBC_SHA1                         0xc0, 0x12      SSL3.0
TLS_ECDHE_RSA_ARCFOUR_128_SHA1                          0xc0, 0x11      SSL3.0
TLS_ECDHE_ECDSA_AES_128_CBC_SHA1                        0xc0, 0x09      SSL3.0
TLS_ECDHE_ECDSA_AES_128_CBC_SHA256                      0xc0, 0x23      TLS1.0
TLS_ECDHE_ECDSA_CAMELLIA_128_CBC_SHA256                 0xc0, 0x72      TLS1.0
TLS_ECDHE_ECDSA_AES_256_CBC_SHA1                        0xc0, 0x0a      SSL3.0
TLS_ECDHE_ECDSA_AES_256_CBC_SHA384                      0xc0, 0x24      TLS1.0
TLS_ECDHE_ECDSA_CAMELLIA_256_CBC_SHA384                 0xc0, 0x73      TLS1.0
TLS_ECDHE_ECDSA_3DES_EDE_CBC_SHA1                       0xc0, 0x08      SSL3.0
TLS_ECDHE_ECDSA_ARCFOUR_128_SHA1                        0xc0, 0x07      SSL3.0
TLS_RSA_AES_128_CBC_SHA1                                0x00, 0x2f      SSL3.0
TLS_RSA_AES_128_CBC_SHA256                              0x00, 0x3c      TLS1.0
TLS_RSA_CAMELLIA_128_CBC_SHA1                           0x00, 0x41      SSL3.0
TLS_RSA_CAMELLIA_128_CBC_SHA256                         0x00, 0xba      TLS1.0
TLS_RSA_AES_256_CBC_SHA1                                0x00, 0x35      SSL3.0
TLS_RSA_AES_256_CBC_SHA256                              0x00, 0x3d      TLS1.0
TLS_RSA_CAMELLIA_256_CBC_SHA1                           0x00, 0x84      SSL3.0
TLS_RSA_CAMELLIA_256_CBC_SHA256                         0x00, 0xc0      TLS1.0
TLS_RSA_3DES_EDE_CBC_SHA1                               0x00, 0x0a      SSL3.0
TLS_RSA_ARCFOUR_128_SHA1                                0x00, 0x05      SSL3.0
TLS_DHE_RSA_AES_128_CBC_SHA1                            0x00, 0x33      SSL3.0
TLS_DHE_RSA_AES_128_CBC_SHA256                          0x00, 0x67      TLS1.0
TLS_DHE_RSA_CAMELLIA_128_CBC_SHA1                       0x00, 0x45      SSL3.0
TLS_DHE_RSA_CAMELLIA_128_CBC_SHA256                     0x00, 0xbe      TLS1.0
TLS_DHE_RSA_AES_256_CBC_SHA1                            0x00, 0x39      SSL3.0
TLS_DHE_RSA_AES_256_CBC_SHA256                          0x00, 0x6b      TLS1.0
TLS_DHE_RSA_CAMELLIA_256_CBC_SHA1                       0x00, 0x88      SSL3.0
TLS_DHE_RSA_CAMELLIA_256_CBC_SHA256                     0x00, 0xc4      TLS1.0
TLS_DHE_RSA_3DES_EDE_CBC_SHA1                           0x00, 0x16      SSL3.0
TLS_DHE_DSS_AES_128_CBC_SHA1                            0x00, 0x32      SSL3.0
TLS_DHE_DSS_AES_128_CBC_SHA256                          0x00, 0x40      TLS1.0
TLS_DHE_DSS_CAMELLIA_128_CBC_SHA1                       0x00, 0x44      SSL3.0
TLS_DHE_DSS_CAMELLIA_128_CBC_SHA256                     0x00, 0xbd      TLS1.0
TLS_DHE_DSS_AES_256_CBC_SHA1                            0x00, 0x38      SSL3.0
TLS_DHE_DSS_AES_256_CBC_SHA256                          0x00, 0x6a      TLS1.0
TLS_DHE_DSS_CAMELLIA_256_CBC_SHA1                       0x00, 0x87      SSL3.0
TLS_DHE_DSS_CAMELLIA_256_CBC_SHA256                     0x00, 0xc3      TLS1.0
TLS_DHE_DSS_3DES_EDE_CBC_SHA1                           0x00, 0x13      SSL3.0
TLS_DHE_DSS_ARCFOUR_128_SHA1                            0x00, 0x66      SSL3.0

Certificate types: none
Protocols: VERS-TLS1.2, VERS-TLS1.1, VERS-TLS1.0, VERS-SSL3.0, VERS-DTLS1.2, VERS-DTLS1.0
Compression: COMP-NULL
Elliptic curves: CURVE-SECP256R1, CURVE-SECP384R1, CURVE-SECP521R1
PK-signatures: SIGN-RSA-SHA256, SIGN-DSA-SHA256, SIGN-ECDSA-SHA256, SIGN-RSA-SHA384, SIGN-ECDSA-SHA384, SIGN-RSA-SHA512, SIGN-ECDSA-SHA512, SIGN-RSA-SHA224, SIGN-DSA-SHA224, SIGN-ECDSA-SHA224, SIGN-RSA-SHA1, SIGN-DSA-SHA1, SIGN-ECDSA-SHA1
############### rawhide #####################
[root@jetson kernel-yum]# systemctl status httpd.service -l
● httpd.service - The Apache HTTP Server
   Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled)
   Active: failed (Result: exit-code) since Tue 2014-10-07 14:14:20 CEST; 2s ago
  Process: 1765 ExecStart=/usr/sbin/httpd $OPTIONS -DFOREGROUND (code=exited, status=1/FAILURE)
 Main PID: 1765 (code=exited, status=1/FAILURE)

Oct 07 14:14:20 jetson httpd[1765]: AH00526: Syntax error on line 5 of /etc/httpd/conf.d/mod_gnutls.conf:
Oct 07 14:14:20 jetson httpd[1765]: GnuTLS: Syntax error parsing priorities string at: "@SYSTEM"
Oct 07 14:14:20 jetson systemd[1]: httpd.service: main process exited, code=exited, status=1/FAILURE
Oct 07 14:14:20 jetson systemd[1]: Failed to start The Apache HTTP Server.
Oct 07 14:14:20 jetson systemd[1]: Unit httpd.service entered failed state.
[root@jetson kernel-yum]# gnutls-cli -l --priority @SYSTEM
Cipher suites for @SYSTEM
TLS_ECDHE_RSA_AES_128_CBC_SHA1                          0xc0, 0x13      SSL3.0
TLS_ECDHE_RSA_AES_128_CBC_SHA256                        0xc0, 0x27      TLS1.0
TLS_ECDHE_RSA_CAMELLIA_128_CBC_SHA256                   0xc0, 0x76      TLS1.0
TLS_ECDHE_RSA_AES_256_CBC_SHA1                          0xc0, 0x14      SSL3.0
TLS_ECDHE_RSA_AES_256_CBC_SHA384                        0xc0, 0x28      TLS1.0
TLS_ECDHE_RSA_CAMELLIA_256_CBC_SHA384                   0xc0, 0x77      TLS1.0
TLS_ECDHE_RSA_3DES_EDE_CBC_SHA1                         0xc0, 0x12      SSL3.0
TLS_ECDHE_RSA_ARCFOUR_128_SHA1                          0xc0, 0x11      SSL3.0
TLS_ECDHE_ECDSA_AES_128_CBC_SHA1                        0xc0, 0x09      SSL3.0
TLS_ECDHE_ECDSA_AES_128_CBC_SHA256                      0xc0, 0x23      TLS1.0
TLS_ECDHE_ECDSA_CAMELLIA_128_CBC_SHA256                 0xc0, 0x72      TLS1.0
TLS_ECDHE_ECDSA_AES_256_CBC_SHA1                        0xc0, 0x0a      SSL3.0
TLS_ECDHE_ECDSA_AES_256_CBC_SHA384                      0xc0, 0x24      TLS1.0
TLS_ECDHE_ECDSA_CAMELLIA_256_CBC_SHA384                 0xc0, 0x73      TLS1.0
TLS_ECDHE_ECDSA_3DES_EDE_CBC_SHA1                       0xc0, 0x08      SSL3.0
TLS_ECDHE_ECDSA_ARCFOUR_128_SHA1                        0xc0, 0x07      SSL3.0
TLS_RSA_AES_128_CBC_SHA1                                0x00, 0x2f      SSL3.0
TLS_RSA_AES_128_CBC_SHA256                              0x00, 0x3c      TLS1.0
TLS_RSA_CAMELLIA_128_CBC_SHA1                           0x00, 0x41      SSL3.0
TLS_RSA_CAMELLIA_128_CBC_SHA256                         0x00, 0xba      TLS1.0
TLS_RSA_AES_256_CBC_SHA1                                0x00, 0x35      SSL3.0
TLS_RSA_AES_256_CBC_SHA256                              0x00, 0x3d      TLS1.0
TLS_RSA_CAMELLIA_256_CBC_SHA1                           0x00, 0x84      SSL3.0
TLS_RSA_CAMELLIA_256_CBC_SHA256                         0x00, 0xc0      TLS1.0
TLS_RSA_3DES_EDE_CBC_SHA1                               0x00, 0x0a      SSL3.0
TLS_RSA_ARCFOUR_128_SHA1                                0x00, 0x05      SSL3.0
TLS_DHE_RSA_AES_128_CBC_SHA1                            0x00, 0x33      SSL3.0
TLS_DHE_RSA_AES_128_CBC_SHA256                          0x00, 0x67      TLS1.0
TLS_DHE_RSA_CAMELLIA_128_CBC_SHA1                       0x00, 0x45      SSL3.0
TLS_DHE_RSA_CAMELLIA_128_CBC_SHA256                     0x00, 0xbe      TLS1.0
TLS_DHE_RSA_AES_256_CBC_SHA1                            0x00, 0x39      SSL3.0
TLS_DHE_RSA_AES_256_CBC_SHA256                          0x00, 0x6b      TLS1.0
TLS_DHE_RSA_CAMELLIA_256_CBC_SHA1                       0x00, 0x88      SSL3.0
TLS_DHE_RSA_CAMELLIA_256_CBC_SHA256                     0x00, 0xc4      TLS1.0
TLS_DHE_RSA_3DES_EDE_CBC_SHA1                           0x00, 0x16      SSL3.0
TLS_DHE_DSS_AES_128_CBC_SHA1                            0x00, 0x32      SSL3.0
TLS_DHE_DSS_AES_128_CBC_SHA256                          0x00, 0x40      TLS1.0
TLS_DHE_DSS_CAMELLIA_128_CBC_SHA1                       0x00, 0x44      SSL3.0
TLS_DHE_DSS_CAMELLIA_128_CBC_SHA256                     0x00, 0xbd      TLS1.0
TLS_DHE_DSS_AES_256_CBC_SHA1                            0x00, 0x38      SSL3.0
TLS_DHE_DSS_AES_256_CBC_SHA256                          0x00, 0x6a      TLS1.0
TLS_DHE_DSS_CAMELLIA_256_CBC_SHA1                       0x00, 0x87      SSL3.0
TLS_DHE_DSS_CAMELLIA_256_CBC_SHA256                     0x00, 0xc3      TLS1.0
TLS_DHE_DSS_3DES_EDE_CBC_SHA1                           0x00, 0x13      SSL3.0
TLS_DHE_DSS_ARCFOUR_128_SHA1                            0x00, 0x66      SSL3.0

Certificate types: none
Protocols: VERS-TLS1.2, VERS-TLS1.1, VERS-TLS1.0, VERS-SSL3.0, VERS-DTLS1.2, VERS-DTLS1.0
Compression: COMP-NULL
Elliptic curves: CURVE-SECP256R1, CURVE-SECP384R1, CURVE-SECP521R1
PK-signatures: SIGN-RSA-SHA256, SIGN-DSA-SHA256, SIGN-ECDSA-SHA256, SIGN-RSA-SHA384, SIGN-ECDSA-SHA384, SIGN-RSA-SHA512, SIGN-ECDSA-SHA512, SIGN-RSA-SHA224, SIGN-DSA-SHA224, SIGN-ECDSA-SHA224, SIGN-RSA-SHA1, SIGN-DSA-SHA1, SIGN-ECDSA-SHA1
Comment 28 Nikos Mavrogiannopoulos 2014-10-07 12:49:37 UTC 
Could you try running "httpd -X" under strace? I'm afraid that this may be SE-linux related, and apache doesn't have the necessary permissions to open /etc/crypto-policies/back-ends/gnutls.config.
Comment 29 Jiri Kastner 2014-10-07 19:32:40 UTC 
it seems related to fact that gnutlspriorities parsing was added 2-3 months before 0.6 release.
i'm going to release 0.6.
Comment 30 Fedora Update System 2014-10-13 13:30:07 UTC 
mod_gnutls-0.6-1.el7 has been submitted as an update for Fedora EPEL 7.
https://admin.fedoraproject.org/updates/mod_gnutls-0.6-1.el7
Comment 31 Fedora Update System 2014-10-13 13:30:43 UTC 
mod_gnutls-0.6-1.fc21 has been submitted as an update for Fedora 21.
https://admin.fedoraproject.org/updates/mod_gnutls-0.6-1.fc21
Comment 32 Fedora Update System 2014-10-13 13:31:10 UTC 
mod_gnutls-0.6-1.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/mod_gnutls-0.6-1.fc20
Comment 33 Fedora Update System 2014-10-13 21:37:54 UTC 
Package mod_gnutls-0.6-1.el7:
* should fix your issue,
* was pushed to the Fedora EPEL 7 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=epel-testing mod_gnutls-0.6-1.el7'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-3300/mod_gnutls-0.6-1.el7
then log in and leave karma (feedback).
Comment 34 Nikos Mavrogiannopoulos 2014-10-27 15:09:22 UTC 
The builds referenced here cannot be found in koji.
Comment 35 Fedora Update System 2015-05-26 21:24:15 UTC 
mod_gnutls-0.6-1.el7 has been pushed to the Fedora EPEL 7 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 36 Fedora Update System 2015-07-14 13:05:22 UTC 
mod_gnutls-0.7-1.fc21 has been submitted as an update for Fedora 21.
https://admin.fedoraproject.org/updates/mod_gnutls-0.7-1.fc21
Comment 37 Fedora Update System 2015-07-20 11:54:00 UTC 
mod_gnutls-0.7-2.fc21 has been submitted as an update for Fedora 21.
https://admin.fedoraproject.org/updates/mod_gnutls-0.7-2.fc21
Comment 38 Fedora Update System 2015-07-30 01:17:03 UTC 
mod_gnutls-0.7-2.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.