Hello community, here is the log from the commit of package apache2 for openSUSE:Factory checked in at 2015-08-14 14:45:53 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/apache2 (Old) and /work/SRC/openSUSE:Factory/.apache2.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "apache2" Changes: -------- --- /work/SRC/openSUSE:Factory/apache2/apache2.changes 2015-08-07 00:18:23.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.apache2.new/apache2.changes 2015-08-14 14:45:55.000000000 +0200 @@ -1,0 +2,14 @@ +Thu Aug 13 13:04:00 UTC 2015 - [email protected] + +- Fixup libdir in installed files + +------------------------------------------------------------------- +Tue Aug 11 15:52:42 UTC 2015 - [email protected] + +- fix Logjam vulnerability: change SSLCipherSuite cipherstring to + disable export cipher suites and deploy Ephemeral Elliptic-Curve + Diffie-Hellman (ECDHE) ciphers. Adjust 'gensslcert' script to + generate a strong and unique Diffie Hellman Group and append it + to the server certificate file [bnc#931723], [CVE-2015-4000] + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ apache2.spec ++++++ --- /var/tmp/diff_new_pack.nXDpsb/_old 2015-08-14 14:45:56.000000000 +0200 +++ /var/tmp/diff_new_pack.nXDpsb/_new 2015-08-14 14:45:56.000000000 +0200 @@ -578,6 +578,13 @@ Group %{httpdgroup} EOF +# fixup libdir +%if "%{_lib}" != "lib64" +sed -e 's/lib64/%{_lib}/' -i \ + %{buildroot}/%{sysconfdir}/loadmodule.conf \ + %{buildroot}/%{_var}/adm/fillup-templates/sysconfig.%{name} +%endif + # remove configuration for mpms which have not been built mpm_confs="$(awk '/IfModule .*\.c/ {print $2}' %{buildroot}/%{sysconfdir}/server-tuning.conf | cut -d. -f1 | tr '\n' ' ')" for mpm_conf in $mpm_confs; do ++++++ apache2-ssl-global.conf ++++++ --- /var/tmp/diff_new_pack.nXDpsb/_old 2015-08-14 14:45:57.000000000 +0200 +++ /var/tmp/diff_new_pack.nXDpsb/_new 2015-08-14 14:45:57.000000000 +0200 @@ -77,8 +77,7 @@ # SSL Cipher Suite: # List the ciphers that the client is permitted to negotiate. # See the mod_ssl documentation for a complete list. - # https://community.qualys.com/blogs/securitylabs/2013/08/05/configuring-apache-nginx-and-openssl-for-forward-secrecy - SSLCipherSuite EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS + SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA # SSLHonorCipherOrder # If SSLHonorCipherOrder is disabled, then the client's preferences ++++++ gensslcert ++++++ --- /var/tmp/diff_new_pack.nXDpsb/_old 2015-08-14 14:45:57.000000000 +0200 +++ /var/tmp/diff_new_pack.nXDpsb/_new 2015-08-14 14:45:57.000000000 +0200 @@ -193,6 +193,9 @@ myexit $LINENO $? fi +echo;myecho generating dhparams and appending it to the server certificate file... +openssl dhparam 2048 >> $sslcrtdir/${name}server.crt + exit 0
