Your message dated Sat, 09 May 2015 19:17:39 +0000
with message-id <[email protected]>
and subject line Bug#765539: fixed in pound 2.6-2+deb7u1
has caused the Debian Bug report #765539,
regarding Not possible to disable SSLv3
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
765539: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=765539
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: pound
Version: 2.6-4
Severity: important
Tags: security
Hello,
I can't see anyway of disabling SSLv3 in Pound, which is now considered
insecure.
In additional, https://www.ssllabs.com/ssltest/ reports that "Secure
Client-Initiated Renegotiation" is supported, and flags this as a security
issue. This is despite the fact that the man page say the default for
SSLAllowClientRenegotiation is 0, which is disabled. I tried including
"SSLAllowClientRenegotiation 0" in my configuration, but it didn't help.
Thanks.
--
Brian May <[email protected]>
--- End Message ---
--- Begin Message ---
Source: pound
Source-Version: 2.6-2+deb7u1
We believe that the bug you reported is fixed in the latest version of
pound, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thijs Kinkhorst <[email protected]> (supplier of updated pound package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Thu, 07 May 2015 19:01:01 +0200
Source: pound
Binary: pound
Architecture: source amd64
Version: 2.6-2+deb7u1
Distribution: wheezy-security
Urgency: high
Maintainer: Brett Parker <[email protected]>
Changed-By: Thijs Kinkhorst <[email protected]>
Description:
pound - reverse proxy, load balancer and HTTPS front-end for Web servers
Closes: 723731 727197 765539 765649
Changes:
pound (2.6-2+deb7u1) wheezy-security; urgency=high
.
[ Brett Parker ]
* Add anti_poodle patch (CVE-2014-3566, Closes: #765539)
- It's now possible to disable SSLv3 with the "DisableSSLv3"
directive in pound.cfg. It's however not disabled by default.
* Disable tls compression patch (CVE-2012-4929, Closes: 727197)
* Add missing chunk to renegotiation patch
(CVE-2009-3555, Closes: #765649).
* don't wrongly encode = in redirect (Closes: #723731)
.
[ Thijs Kinkhorst ]
* Upload to wheezy-security.
Checksums-Sha1:
0d053e7aa0b9ef3df63b4bfb48d7c3fc841448a1 1390 pound_2.6-2+deb7u1.dsc
530a428ae8a94fc48f0b6037f3a601e24e65589e 14484 pound_2.6-2+deb7u1.debian.tar.gz
419684622a84fe3f478dd7c43ba58e01d0637972 111460 pound_2.6-2+deb7u1_amd64.deb
Checksums-Sha256:
f004ebc81adafcc80a843c159cfa9c36141a58645998d7719a58fb1960d374fb 1390
pound_2.6-2+deb7u1.dsc
6c660935044ff9312d5b3d9352cecb5f850789536aaa0cbff6d2795f4bc4fb83 14484
pound_2.6-2+deb7u1.debian.tar.gz
5843e46e1eba7ae1541da5519c2d1ee45cf573eaafc224a88cfc003080e00530 111460
pound_2.6-2+deb7u1_amd64.deb
Files:
8fc92ddeeb6236269c94da7c1ef5fafa 1390 net extra pound_2.6-2+deb7u1.dsc
e2e69d160d3afe029ce72dab96adeceb 14484 net extra
pound_2.6-2+deb7u1.debian.tar.gz
fa2e71f92b1fd17b937cdf6b9a7a5af6 111460 net extra pound_2.6-2+deb7u1_amd64.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQEcBAEBCAAGBQJVS6d8AAoJEFb2GnlAHawEZ18H/3WjyP5Ps5nlA6fEj3fpo1gZ
f4gBpt5N0wsyl3MX0levnswwKtBRvwdwHuHZcElGIA6m1AOZpTnyvk4SOvaN05RN
+3ZrlWc6bMUaPetiaY8vhCFJkcupEgwG3zHrA7DaB9uCELwacrQJFj+97g6fju6N
Se9+3D6ItyFRaf38WD2iNtClpnPJLMZ9TMeDSxPc+RZyfGYn3LUNOJ5VdaN4G0HG
g7HMZD9hzvTE4cmxDgOdizwBWSbFEC9p6HfHp2+fw7A6mhMMYUFd+fKEnZe5s3l8
iwN9tIdrnIWBOoUyNcdM26FHkLxDhbDL0MRHGlHhowMbex10GrOLr+B1qMfRGkA=
=wpYr
-----END PGP SIGNATURE-----
--- End Message ---
