Bug 1337463
| Summary: | Disable/remove export ciphersuites in NSS | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Nikos Mavrogiannopoulos <nmavrogi> |
| Component: | nss | Assignee: | Daiki Ueno <dueno> |
| Status: | CLOSED ERRATA | QA Contact: | Hubert Kario <hkario> |
| Severity: | unspecified | Docs Contact: | Mirek Jahoda <mjahoda> |
| Priority: | unspecified | ||
| Version: | 6.9 | CC: | dueno, hkario, kengert, rrelyea, szidek |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | nss-3.27.1-1.el6 | Doc Type: | Deprecated Functionality |
| Doc Text: |
The EXPORT cipher suites in *NSS* are deprecated
This change removes support for the EXPORT cipher suites in the Network Security Services (NSS) library. Disabling the weak cipher suites prevents attacks such as the FREAK attack. The EXPORT cipher suites are not required in any *TLS* protocol configuration.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2017-03-21 10:26:53 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1335911, 1343211 | ||
|
Description
Nikos Mavrogiannopoulos
2016-05-19 09:21:51 UTC
(In reply to Nikos Mavrogiannopoulos from comment #0) > This bug is about disabling by default and removing the ability to negotiate > the marked as EXPORT ciphersuites. It should not be possible by applications > to inadvertently enable them. Nikos, it's not clear to me what "not possible to inadvertently enable" mean. Does that mean, you want to completely remove the ability to enable them? Yes, the bug is about removing any possibility of negotiating them. Ok. In my understanding, upstream NSS 3.27 still allows the application to enable the export ciphersuites. This means, we require a downstream patch to make it impossible to enable them. I believe Elio has done this work already for RHEL 7.x We should check which patches from rhel-7.3 are required, and merge them to rhel-6.9 I suppose the relevant patches are: http://pkgs.devel.redhat.com/cgit/rpms/nss/tree/Bug-1001841-disable-sslv2-libssl.patch?h=rhel-7.3 http://pkgs.devel.redhat.com/cgit/rpms/nss/tree/Bug-1001841-disable-sslv2-tests.patch?h=rhel-7.3 Yes, the patches mentioned in comment 8 look right. I don't know if there's anything that might be required. Hubert, will your tests tell us if we have correctly disabled all ciphers? yes, I have a test case which checks what ciphers and in which order are sent by tstsclnt by default Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHEA-2017-0671.html |