| Summary: | Disable support for SSLv2 completely. | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Hubert Kario <hkario> |
| Component: | nss | Assignee: | Elio Maldonado Batiz <emaldona> |
| Status: | CLOSED ERRATA | QA Contact: | Hubert Kario <hkario> |
| Severity: | unspecified | Docs Contact: | Jana Heves <jsvarova> |
| Priority: | unspecified | ||
| Version: | 6.7 | CC: | emaldona, jsvarova, kengert, ksrot, nmavrogi, rrelyea, thoger |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | nss-3.21.0-5.el6 | Doc Type: | Release Note |
| Doc Text: |
Support for SSLv2 has been disabled
SSLv2 is insecure and should not be used in current deployments, and thus has been disabled without a way to override. All modern browsers and frameworks cannot negotiate SSLv2 connections in default configuration and many cannot be configured to perform SSLv2 negotiation. A recent OpenSSL vulnerability (CVE-2015-3197) shows that keeping this code is a liability. In addition, upstream has already removed support for SSLv2 (MZBZ#1228555).
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2016-05-10 21:10:20 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Bug Depends On: | 1311981 | ||
| Bug Blocks: | 1306607 | ||
| Attachments: | |||
|
Description
Hubert Kario
2016-02-04 16:58:26 UTC
Created attachment 1132852 [details]
disable ssl2 suppport - libssl part
Created attachment 1132853 [details]
disable ssl2 support - test scripts part
Created attachment 1132855 [details]
Add "-c v " to tstclnt invocation for ocsp stapling tests and some SNI tests.
Created attachment 1132859 [details]
ensure in ssl stress tool invocation lower protocol in range is ssl3
don't rely on default for minimum wnich is currently ssl2
Created attachment 1132860 [details]
For ssl authentication tests ensure ssl3 is the minimum and not ssl2
Created attachment 1132861 [details]
nss.spec file changes - in patch format
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-0820.html |