Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1745008

Summary:	[OSP15] Libvirt allows weak encryption protocol (SSLv3 CBC)
Product:	Red Hat OpenStack	Reporter:	Martin Schuppert <mschuppe>
Component:	puppet-nova	Assignee:	Martin Schuppert <mschuppe>
Status:	CLOSED ERRATA	QA Contact:	OSP DFG:Compute <osp-dfg-compute>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	15.0 (Stein)	CC:	fduthill, jagee, jjoyce, jpadman, jschluet, lhh, lyarwood, mbooth, mschuppe, nkinder, nlevinki, nova-maint, ratailor, slinaber, slong, tvignaud
Target Milestone:	z2	Keywords:	TestOnly, Triaged, ZStream
Target Release:	15.0 (Stein)
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	puppet-nova-14.4.1-0.20191011200450.fd55aae.el8ost openstack-tripleo-heat-templates-10.6.2-0.20191021140437.5305e48.el8ost	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:	1740575
Clones:	1745010 (view as bug list)		Environment:
Last Closed:	2020-03-05 11:59:15 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1740575
Bug Blocks:	1745010, 1745012

Comment 2 Nathan Kinder 2019-08-28 21:20:33 UTC

Adding external tracker for the upstream stable/stein tripleo-heat-templates portion of this issue:

  https://review.opendev.org/678993

Comment 3 Rajesh Tailor 2019-09-03 09:59:38 UTC

The patch [1] and [2] are already in RHOS-15 in puppet-nova and openstack-tripleo-heat-teamplates repos.

1) For puppet-nova repo:
    $ git branch --contains b28b01a01f940af2356d348cf66d2dcdfa8ef25a
    * rhos-15.0-trunk-patches

From RHOS-15 branch:
    $ git show b28b01a01f940af2356d348cf66d2dcdfa8ef25a
    commit b28b01a01f940af2356d348cf66d2dcdfa8ef25a (openstack/stable/stein)
    Author: Martin Schuppert <mschuppert>
    Date:   Fri Aug 16 14:56:45 2019 +0200

        Adds tls_priority parameter to nova::compute::libvirt
    
        Override the compile time default TLS priority string. The
        default is usually "NORMAL" unless overridden at build time.
        Only set this if it is desired for libvirt to deviate from
        the global default settings.
    
        Change-Id: I221d48ba720e8ad820050fb5f735cd20d75f2f7a
        Related-Bug: #1840447
        (cherry picked from commit 7f9c58f86cb4c7505fa04f0ad7e723ada09034ba)

[...]

2) For opentack-tripleo-heat-templates repo:
    $ git branch --contains 393f43a664b16fe284b54c75320a2c7f09d18579
    * rhos-15.0-trunk-patches

From RHOS-15 branch:

    $ git show 393f43a664b16fe284b54c75320a2c7f09d18579
    commit 393f43a664b16fe284b54c75320a2c7f09d18579
    Author: Martin Schuppert <mschuppert>
    Date:   Fri Aug 16 15:52:20 2019 +0200

        Add LibvirtTLSPriority to set libvirtd tls_priority
    
        Adds LibvirtTLSPriority parameter to override the compile time
        default TLS priority string.
        Default: 'NORMAL:-VERS-SSL3.0:-VERS-TLS-ALL:+VERS-TLS1.2'
    
        Change-Id: Id05c5e88be2d9f90642ed5159cb2db03c997f83a
        Closes-Bug: #1840447
        (cherry picked from commit 56ccd717d48aca2d3138c1f4416baa72d3655216)

[...]

[1] https://review.opendev.org/#/c/677999/
[2] https://review.opendev.org/#/c/678993/

Comment 9 errata-xmlrpc 2020-03-05 11:59:15 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:0643