Bug 1158227
| Summary: | pcsd should not accept SSLv2 and v3 | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Cedric Buissart <cbuissar> |
| Component: | pcs | Assignee: | Tomas Jelinek <tojeline> |
| Status: | CLOSED ERRATA | QA Contact: | michal novacek <mnovacek> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.1 | CC: | cfeist, cluster-maint, mnovacek, pvn, rsteiger, tojeline |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | pcs-0.9.135-1.el7 | Doc Type: | Bug Fix |
| Doc Text: |
Cause:
pcsd accepts SSLv3 and SSLv2 connections.
Consequence:
pcsd is possibly vulnerable to POODLE attack and other attacks using SSLv2 and SSLv3.
Fix:
Deny SSLv2 and SSLv3 connections in pcsd.
Result:
pcsd does not accept SSLv2 nor SSLv3 connections
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-03-05 09:20:46 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Cedric Buissart
2014-10-28 21:17:37 UTC
Before Fix: [root@rh70-node1 ~]# rpm -q pcs pcs-0.9.115-32.el7.x86_64 [root@rh70-node1:~]# openssl s_client -connect rh70-node1:2224 -quiet -ssl3 depth=0 C = US, ST = MN, L = Minneapolis, O = pcsd, OU = pcsd, CN = localhost verify error:num=18:self signed certificate verify return:1 depth=0 C = US, ST = MN, L = Minneapolis, O = pcsd, OU = pcsd, CN = localhost verify return:1 HEAD / HTTP/1.0 HTTP/1.1 303 See Other Content-Type: text/html;charset=utf-8 Location: https://rh70-node1:2224/login Content-Length: 0 X-Xss-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Server: WEBrick/1.3.1 (Ruby/2.0.0/2013-11-22) OpenSSL/1.0.1e Date: Thu, 30 Oct 2014 11:10:11 GMT Connection: close [root@rh70-node1:~]# echo $? 0 [root@rh70-node1:~]# openssl s_client -connect rh70-node1:2224 -quiet -ssl2 depth=0 C = US, ST = MN, L = Minneapolis, O = pcsd, OU = pcsd, CN = localhost verify error:num=18:self signed certificate verify return:1 depth=0 C = US, ST = MN, L = Minneapolis, O = pcsd, OU = pcsd, CN = localhost verify return:1 139701542541216:error:1406D0B8:SSL routines:GET_SERVER_HELLO:no cipher list:s2_clnt.c:452: [root@rh70-node1:~]# echo $? 1 [root@rh70-node1:~]# ./poodle.sh localhost 2224 localhost:2224 - Vulnerable! SSLv3 connection established using SSLv3/DHE-RSA-AES256-SHA After Fix: [root@rh70-node1:~]# rpm -q pcs pcs-0.9.135-1.el7.x86_64 [root@rh70-node1:~]# openssl s_client -connect rh70-node1:2224 -quiet -ssl3 140517466339232:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1256:SSL alert number 40 140517466339232:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:596: [root@rh70-node1:~]# echo $? 1 [root@rh70-node1:~]# openssl s_client -connect rh70-node1:2224 -quiet -ssl2 write:errno=104 [root@rh70-node1:~]# echo $? 1 [root@rh70-node1:~]# ./poodle.sh localhost 2224 localhost:2224 - Not vulnerable. Failed to establish SSLv3 connection. I have verified that pcs gui is not vulnerable to poodle attack anymore in pcs-0.9.137-11.el7.x86_64 --- [root@duck-01 ~]# openssl s_client -connect duck-01:2224 -quiet -ssl3 140149196085152:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1257:SSL alert number 40 140149196085152:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:596: [root@duck-01 ~]# echo $? 1 [root@duck-01 ~]# openssl s_client -connect duck-01:2224 -quiet -ssl2 write:errno=104 [root@duck-01 ~]# echo $? 1 [root@duck-01 ~]# ./poodle.sh localhost 2224 not vulnerable Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-0415.html |