Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1182619

Summary:	ALL in ssl_protocols does not match TLSv1.{1,2}
Product:	Red Hat Enterprise Linux 6	Reporter:	Michal Hlavinka <mhlavink>
Component:	dovecot	Assignee:	Michal Hlavinka <mhlavink>
Status:	CLOSED ERRATA	QA Contact:	Frantisek Sumsal <fsumsal>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	6.6	CC:	dominik, fsumsal, hhorak, leonard-rh-bugzilla, mdshaikh, psklenar, redhat-bugzilla, robert.scheck, tis
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	dovecot-2.0.9-14.el6	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:	1153041	Environment:
Last Closed:	2015-07-22 06:57:46 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Michal Hlavinka 2015-01-15 15:09:46 UTC

there seems to be in a issue with the dovecot-2.0.9-sslprot.patch released with 2.0.9-8.el6_6.4.

DOVECOT_SSL_PROTO_ALL is defined as 0x07 which was correct when only SSLv2 (0x01), SSLv3 (0x02) and TLSv1 (0x04) were defined. However after adding TLSv1_1 (0x08) and TLSv1_2 (0x10) DOVECOT_SSL_PROTO_ALL should now be 0x1f not 0x07.

Also the last lines from openssl_get_protocol_options() from 2.2.15's src/lib-ssl-iostream/iostream-openssl-common.c where the options are set based on the excluded protocols
... op |= SSL_OP_NO_TLSv1_1;
and 
...TLSv1_2 
seemed to have not been merged into ssl_proxy_ctx_set_protocols() in this patch 

it will make it impossible to disable (exclude) TLSv1_1 and TLSv1_2.

--- Additional comment from Leonard den Ottolander on 2015-01-05 18:12:43 EST ---

Set DOVECOT_SSL_PROTO_ALL to 0x1f.
Added exclude logic for TLSv1_1 and TLSv1_2.

Comment 1 Robert Scheck 2015-01-15 15:43:29 UTC

Cross-filed case #01259137 on the Red Hat customer portal.

Comment 2 Leonard den Ottolander 2015-01-15 23:35:08 UTC

See patch attached to bug 1153041#comment 26.

Comment 5 errata-xmlrpc 2015-07-22 06:57:46 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-1348.html