Your message dated Mon, 06 Apr 2015 19:47:09 +0000 with message-id <[email protected]> and subject line Bug#767026: fixed in ircd-hybrid 1:7.2.2.dfsg.2-10+deb7u1 has caused the Debian Bug report #767026, regarding ircd-hybrid: can't disable SSLv3 to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 767026: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=767026 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---package: ircd-hybrid version: 1:7.2.2.dfsg.2-10 tags: security patch Control: fixed -1 1:8.0.4.dfsg.1-1 So I looked how to disable SSLv3 in ircd-hybrid and didn't find anything. It seems that in the v8 version they disable SSLv2 and SSLv3 while in the v7 version they only disable SSLv2. I applied the change at the bottom of this mail to disable SSLv3 in the v7 version which is currently in Wheezy. Giving the fact that one should disable SSLv3 and that this package has to be manually recompiled in order to enable SSL at all - how are the chances that an update hits Wheezy? :) diff --git a/src/ircd.c b/src/ircd.c --- a/src/ircd.c +++ b/src/ircd.c @@ -512,7 +512,7 @@ init_ssl(void) ilog(L_CRIT, "ERROR: Could not initialize the SSL context -- %s\n", s); } - SSL_CTX_set_options(ServerInfo.ctx, SSL_OP_NO_SSLv2); + SSL_CTX_set_options(ServerInfo.ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3); SSL_CTX_set_options(ServerInfo.ctx, SSL_OP_TLS_ROLLBACK_BUG|SSL_OP_ALL); SSL_CTX_set_verify(ServerInfo.ctx, SSL_VERIFY_NONE, NULL); -- 1.7.10.4 Sebastian
--- End Message ---
--- Begin Message ---Source: ircd-hybrid Source-Version: 1:7.2.2.dfsg.2-10+deb7u1 We believe that the bug you reported is fixed in the latest version of ircd-hybrid, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to [email protected], and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Dominic Hargreaves <[email protected]> (supplier of updated ircd-hybrid package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing [email protected]) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Sun, 05 Apr 2015 18:33:33 +0100 Source: ircd-hybrid Binary: ircd-hybrid hybrid-dev Architecture: all source Version: 1:7.2.2.dfsg.2-10+deb7u1 Distribution: stable Urgency: medium Maintainer: Dominic Hargreaves <[email protected]> Changed-By: Dominic Hargreaves <[email protected]> Closes: 767026 Description: hybrid-dev - development files for ircd-hybrid ircd-hybrid - high-performance secure IRC server Changes: ircd-hybrid (1:7.2.2.dfsg.2-10+deb7u1) stable; urgency=medium . * Disable SSLv3 to mitigate against the POODLE vulnerability (Closes: #767026) Checksums-Sha1: 322a493f271c6a51ba7c89f58bc7261fd7c717ab 2021 ircd-hybrid_7.2.2.dfsg.2-10+deb7u1.dsc ba6705031015c3d3c432581ffd2ad0c36ff9729d 111180 ircd-hybrid_7.2.2.dfsg.2-10+deb7u1.diff.gz 2c98a23581f50da53568ad3b7e97410b4bc0ef96 64924 hybrid-dev_7.2.2.dfsg.2-10+deb7u1_all.deb Checksums-Sha256: 3e35db4b86cb70bdbe4b24bf667db9d09b8c9d3d6fd2a6a76e9c6a788445383c 2021 ircd-hybrid_7.2.2.dfsg.2-10+deb7u1.dsc 973fe55ceac55378e3b7f7b3e21d6b5b5c496a63344eef2d7f0ad91e7e505173 111180 ircd-hybrid_7.2.2.dfsg.2-10+deb7u1.diff.gz 2354c94588c10c6cbfe78da14023d39c9c008d0eb1e170b244a54ab62e4b710f 64924 hybrid-dev_7.2.2.dfsg.2-10+deb7u1_all.deb Files: fc6712f470f534c83a2710507de12ddd 2021 net optional ircd-hybrid_7.2.2.dfsg.2-10+deb7u1.dsc 079046277ae42100bf2012b6da1c8e74 111180 net optional ircd-hybrid_7.2.2.dfsg.2-10+deb7u1.diff.gz f54d1ac023495e070cb01fe9fb8d0add 64924 devel optional hybrid-dev_7.2.2.dfsg.2-10+deb7u1_all.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCAAGBQJVIYQ5AAoJEMAFfnFNaU+ykL8P/i/BsxLOUWvj6RFXdFCesAi7 qBQcnEtf3mU2EKhH+dgWhc/1fZvOpAGWcrw1MG/zkWOFgbdG5vuUHb0mz8+EUU8f Q/asBk+vUcgOIPoeohD37YdHPZLSHBKvbFkeMgu1tXajtpee/J/VvDODmZFdshtL yU3xCSNRIEdhtP06R5lykbI6NYESki49zi14dHURbcujqN3R4AaAjlBgb9Mo7IHj Eyc8diXmU7atOzu4912/3MeQ+Zv4B8yQ27VNbxFAQgjpbIpKGoOo3dfHEDqW2+Nz XrJJddSSBxdoawTlWtay8+8p60BB7rE8B12ccbLRadDzlys2LV7kLSed0yWru/su /z5G8lPKbEFGDUFcqrOlV//Zx/WdQQnKVRIBWhP7UJZcXpY/FWjOXWMd3HO6Dyvl 3Wyw9At66zmwDmEmTTMj1AfLr8w/rEQUclfv9UYojPkbqw6npYxrUkezqzxMdGwF j1B2zplhl0J3uenQ1l/Z/ZdCKbCmb5ouz2s1i2qlHBrrAyTPA4DC7jbBrNc+OEKI lMTzi+byUeyVhhFhIcJs1JIGWwQI+zRNJUkV5ZBPFnu0cdmiQTyMULYRuAxdKUvt me0NTwbm4zMJeR0Tbk3COuOmFvr/C1Yi766YtM3YD7i42Kp73cAZxtp6JcS+2twI UU4g3ak2MIpongSDuAy2 =JDsh -----END PGP SIGNATURE-----
--- End Message ---
