Bug 1320566

Summary:	Patches enabling TLSv1.2 accidentally enabled SSLv3
Product:	Red Hat Enterprise Linux 6	Reporter:	Stefan Kremen <skremen>
Component:	stunnel	Assignee:	Tomas Mraz <tmraz>
Status:	CLOSED NOTABUG	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	high	Docs Contact:
Priority:	high
Version:	6.8
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-03-23 14:13:19 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:

Description Stefan Kremen 2016-03-23 14:02:34 UTC

Description of problem:
In stunnel-4.29-3.el6_6.1 in default configuration, when Server Hello advertises SSL 3.0 only, stunnel replies with "Handshake Failure" and rejects the connection.
Now in stunnel-4.29-6.el6 in default configuration stunnel accepts SSL 3.0 which is insecure.

Version-Release number of selected component (if applicable):
stunnel-4.29-6.el6

How reproducible:
always

Steps to Reproduce:
1. configure stunnel without sslVersion directive in stunnel.conf
2. configure "openssl s_server" with "-ssl3" option

Actual results:
Connection from stunnel to s_server established

Expected results:
Connection from stunnel to s_server rejected

Additional info:

Comment 1 Tomas Mraz 2016-03-23 14:13:19 UTC

The change was not accidental. This is fix for bug 1215707.