Bug 1169871

The RHEL 6.7 equivalent of this bug, 'Bugzilla Bug #1160870 - Default configuration enables SSL3' was marked as a duplicate of 'Bugzilla Bug #1166316 - Rebase mod_nss to support TLSv1.2' (RHEL 6.7), I did mark that as a part of the fix for this bug,  the 'SSLv3,' string should be removed from the 'NSSProtocol SSLv3,TLSv1.0,TLSv1.1' line in the default 'nss.conf' file.

The difference as to why this bug should not be handled in the same manner, however, is that 'Bugzilla Bug #1160745 - RFE: add TLSv1.2 support to mod_nss' (the equivalent to RHEL 6.7 Bugzilla Bug #1166316) has been slated to not be fixed until RHEL 7.2, and it seems that if the appropriate ACKS can be obtained for this bug, it could be addressed in the RHEL 7.1 timeframe by the following simple change to the default 'nss.conf' file:

Change the 'nss.conf' line:

    NSSProtocol SSLv3,TLSv1.0,TLSv1.1

to:

    NSSProtocol TLSv1.0,TLSv1.1

Created attachment 976632 [details]
Default NSSProtocol patch

Remove 'SSLv3' from the default NSSProtocol list defined in 'nss.conf'.

Created attachment 976633 [details]
Default NSSProtocol patch (spec file)

Accompanying spec file for 'mod_nss-default-NSSProtocol.patch'.

Comment on attachment 976632 [details]
Default NSSProtocol patch

If for some reasaon there is no NSSProtocol setting then it will fall back to its defaults which currently includes ssl3 I think you want this change as well:

--- a/nss_engine_init.c
+++ b/nss_engine_init.c
@@ -646,9 +646,9 @@ static void nss_init_ctx_protocol(server_rec *s,
     } else {
         if (mctx->auth.protocols == NULL) {
             ap_log_error(APLOG_MARK, APLOG_WARNING, 0, s,
-                "%s value not set; using: SSLv3, TLSv1.0, TLSv1.1 and TLSv1
.2",
+                "%s value not set; using: TLSv1.0, TLSv1.1 and TLSv1.
2",
                 protocol_marker);
-            ssl3 = tls = tls1_1 = tls1_2 = 1;
+            tls = tls1_1 = tls1_2 = 1;
         } else {
             lprotocols = strdup(mctx->auth.protocols);
             ap_str_tolower(lprotocols);

Created attachment 976903 [details]
Default NSSProtocol patch (revised)

Thanks Rob -- good catch!

Note that this change does not include TLS v1.2 since this version of mod_nss on RHEL 7.1 does not yet include a TLS v1.2 implementation.

Comment on attachment 976903 [details]
Default NSSProtocol patch (revised)

LGTM

# cat /etc/redhat-release 
Red Hat Enterprise Linux Server release 7.1 Beta (Maipo)



# cat /etc/httpd/conf.d/nss.conf | grep NSSProtocol
#   middle of a range may be excluded, the entry "NSSProtocol SSLv3,TLSv1.1"
#   is identical to the entry "NSSProtocol SSLv3,TLSv1.0,TLSv1.1".
NSSProtocol TLSv1.0,TLSv1.1

# rpm -qi mod_nss
Name        : mod_nss
Version     : 1.0.8
Release     : 33.el7
Architecture: x86_64
Install Date: Wed 14 Jan 2015 04:08:08 PM EST
Group       : System Environment/Daemons
Size        : 268214
License     : ASL 2.0
Signature   : RSA/SHA256, Thu 08 Jan 2015 11:20:12 AM EST, Key ID 938a80caf21541eb
Source RPM  : mod_nss-1.0.8-33.el7.src.rpm
Build Date  : Tue 06 Jan 2015 03:56:41 PM EST
Build Host  : x86-018.build.eng.bos.redhat.com
Relocations : (not relocatable)
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
Vendor      : Red Hat, Inc.
URL         : http://directory.fedoraproject.org/wiki/Mod_nss
Summary     : SSL/TLS module for the Apache HTTP server
Description :
The mod_nss module provides strong cryptography for the Apache Web
server via the Secure Sockets Layer (SSL) and Transport Layer
Security (TLS) protocols using the Network Security Services (NSS)
security library.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-0605.html