Bug 566659

Summary:	[RFE] mod_ssl: Add SSLInsecureRenegotiation directive [rhel-5]
Product:	Red Hat Enterprise Linux 5	Reporter:	Tomas Hoger <thoger>
Component:	httpd	Assignee:	Joe Orton <jorton>
Status:	CLOSED ERRATA	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	5.4	CC:	lsmid, mvadkert, riek, zmraz
Target Milestone:	rc	Keywords:	FutureFeature, ZStream
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Enhancement
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2010-03-30 08:28:37 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	567980

Description Tomas Hoger 2010-02-19 08:13:26 UTC

+++ This bug was initially created as a clone of Bug #561435 +++

Description:
The SSLInsecureRenegotiation directive should be added from upstream, to
allow renegotiation with unpatched clients, after the fix for
CVE-2009-3555 was implemented in OpenSSL.

http://svn.apache.org/viewvc?rev=906039&view=rev

Comment 1 Tomas Hoger 2010-02-19 08:25:06 UTC

OpenSSL packages will be updated to address CVE-2009-3555 (see bug #533125), which will deny TLS session renegotiation with unpatched clients.  mod_ssl configurations depending on TLS renegotiation (see kbase DOC-20491 for examples) may become problematic during the transition period (when server is upgraded, but not all clients are upgraded yet).  httpd upstream introduced new configuration directive - SSLInsecureRenegotiation - that can be used to temporarily re-enable unsafe (i.e. vulnerable) legacy renegotiation during the transition period.

Alternative for server admins with such configurations is to not upgrade openssl on the server while clients are still un-upgraded.  Or configuration can be changed to avoid the use of renegotiation (see kbase).

Comment 14 errata-xmlrpc 2010-03-30 08:28:37 UTC

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2010-0252.html