Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

For bugs related to Red Hat Enterprise Linux 5 product line. The current stable release is 5.10. For Red Hat Enterprise Linux 6 and above, please visit Red Hat JIRA https://issues.redhat.com/secure/CreateIssue!default.jspa?pid=12332745 to report new issues.

Bug 1218334

Summary:	luci still agrees on SSLv2 and SSLv3 connections by default
Product:	Red Hat Enterprise Linux 5	Reporter:	Jan Pokorný [poki] <jpokorny>
Component:	conga	Assignee:	Ryan McCabe <rmccabe>
Status:	CLOSED WONTFIX	QA Contact:	cluster-qe <cluster-qe>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	5.11	CC:	cbuissar, cfeist, cluster-maint, cluster-qe, fdinitto, jpokorny, mspqa-list, rmccabe, rsteiger, sbradley, swatson, thoger
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:	1156533	Environment:
Last Closed:	2017-04-18 21:57:43 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1075176, 1156157, 1156533
Bug Blocks:

Description Jan Pokorný [poki] 2015-05-04 16:03:58 UTC

Ditto luci/RHEL 5.

Easy to tackle by configuration stunnel in a more cautious way.

+++ This bug was initially created as a clone of Bug #1156533 +++

+++ This bug was initially created as a clone of Bug #1156157 +++

Due to an ever-increasing attention being paid to minimal acceptable
version of SSL/TLS and/or their ciphers (security scanners, etc.)
and because {luci,ccs,ccs_sync}-ricci communication should be just
fine with TLS1.0+.

While the original [bug 1075176] conditionally disables SSLv2, I think
we should:
- treat SSLv3 the same as SSLv3
- invert the respective default: go secure and allow to revert to
                                 previous behavior (for the utterly
                                 obscure use cases)

To be noted that relying merely on security scanners tends to provide
false sense of overall security; certificate management (conga using
self-signed ones with limited options to roll up custom ones) is a much
weaker point here (see also [bz885028]).

Comment 2 Chris Williams 2017-04-18 21:57:43 UTC

Red Hat Enterprise Linux 5 shipped it's last minor release, 5.11, on September 14th, 2014. On March 31st, 2017 RHEL 5 exited Production Phase 3 and entered Extended Life Phase. For RHEL releases in the Extended Life Phase, Red Hat  will provide limited ongoing technical support. No bug fixes, security fixes, hardware enablement or root-cause analysis will be available during this phase, and support will be provided on existing installations only.  If the customer purchases the Extended Life-cycle Support (ELS), certain critical-impact security fixes and selected urgent priority bug fixes for the last minor release will be provided.  For more details please consult the Red Hat Enterprise Linux Life Cycle Page:
https://access.redhat.com/support/policy/updates/errata

This BZ does not appear to meet ELS criteria so is being closed WONTFIX. If this BZ is critical for your environment and you have an Extended Life-cycle Support Add-on entitlement, please open a case in the Red Hat Customer Portal, https://access.redhat.com ,provide a thorough business justification and ask that the BZ be re-opened for consideration of an errata. Please note, only certain critical-impact security fixes and selected urgent priority bug fixes for the last minor release can be considered.