Your message dated Wed, 09 Mar 2016 22:02:05 +0000
with message-id <[email protected]>
and subject line Bug#811158: Removed package(s) from unstable
has caused the Debian Bug report #788895,
regarding mysql-5.5: defaults to 512-bit FFDHE; should be at least 2048-bit
FFDHE
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
788895: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=788895
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: mysql-5.5
Version: 5.1.73-1
Severity: important
Tags: upstream patch
Control: forwarded -1 http://bugs.mysql.com/bug.php?id=77275
all existing versions of MySQL present a 512-bit modulus when
negotiating a Finite-Field Diffie-Hellman Ephemeral (FFDHE) handshake
in TLS. This is grossly negligent (see https://weakdh.org)
Upstream's bug fix (complete with novel Finite Field DHE group, whose
structure i have not yet examined) is here:
https://github.com/mysql/mysql-server/commit/866b988a76e8e7e217017a7883a52a12ec5024b9
This (or something like it, using a well-analyzed group) should
probably be applied to all supported versions of MySQL.
--dkg
-- System Information:
Debian Release: stretch/sid
APT prefers testing
APT policy: (500, 'testing'), (200, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 4.0.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
--- End Message ---
--- Begin Message ---
Version: 5.5.46-0+deb8u1+rm
Dear submitter,
as the package mysql-5.5 has just been removed from the Debian archive
unstable we hereby close the associated bug reports. We are sorry
that we couldn't deal with your issue properly.
For details on the removal, please see https://bugs.debian.org/811158
The version of this package that was in Debian prior to this removal
can still be found using http://snapshot.debian.org/.
This message was generated automatically; if you believe that there is
a problem with it please contact the archive administrators by mailing
[email protected].
Debian distribution maintenance software
pp.
Scott Kitterman (the ftpmaster behind the curtain)
--- End Message ---
