Your message dated Thu, 21 Apr 2016 09:51:02 +0000 with message-id <[email protected]> and subject line Bug#770399: fixed in libio-socket-ssl-perl 2.027-1 has caused the Debian Bug report #770399, regarding libio-socket-ssl-perl: questioning choice of default cipher list to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 770399: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770399 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---Package: libio-socket-ssl-perl Version: 2.002-1 Severity: important Hi, I was just looking at why lwp is behaving with https like it is, and it seems the cipher list being set up is really crappy. It contains: ============ # global defaults my %DEFAULT_SSL_ARGS = ( SSL_check_crl => 0, SSL_version => 'SSLv23:!SSLv3:!SSLv2', # consider both SSL3.0 and SSL2.0 as broken SSL_verify_callback => undef, SSL_verifycn_scheme => undef, # fallback cn verification SSL_verifycn_publicsuffix => undef, # fallback default list verification #SSL_verifycn_name => undef, # use from PeerAddr/PeerHost - do not override in set_args_filter_hack 'use_defaults' SSL_npn_protocols => undef, # meaning depends whether on server or client side SSL_cipher_list => 'EECDH+AESGCM+ECDSA EECDH+AESGCM EECDH+ECDSA +AES256 EECDH EDH+AESGCM '. 'EDH ALL +SHA +3DES +RC4 !LOW !EXP !eNULL !aNULL !DES !MD5 !PSK !SRP', ); my %DEFAULT_SSL_CLIENT_ARGS = ( %DEFAULT_SSL_ARGS, SSL_verify_mode => SSL_VERIFY_PEER, SSL_ca_file => undef, SSL_ca_path => undef, # older versions of F5 BIG-IP hang when getting SSL client hello >255 bytes # http://support.f5.com/kb/en-us/solutions/public/13000/000/sol13037.html # http://guest:[email protected]/Ticket/Display.html?id=2771 # Debian works around this by disabling TLSv1_2 on the client side # Chrome and IE11 use TLSv1_2 but use only a few ciphers, so that packet # stays small enough # The following list is taken from IE11, except that we don't do RC4-MD5, # RC4-SHA is already bad enough. Also, we have a different sort order # compared to IE11, because we put ciphers supporting forward secrecy on top SSL_cipher_list => join(" ", qw( ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES128-SHA256 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES256-SHA384 ECDHE-ECDSA-AES128-SHA ECDHE-ECDSA-AES256-SHA ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA DHE-DSS-AES128-SHA256 DHE-DSS-AES128-SHA DHE-DSS-AES256-SHA256 DHE-DSS-AES256-SHA AES128-SHA256 AES128-SHA AES256-SHA256 AES256-SHA EDH-DSS-DES-CBC3-SHA DES-CBC3-SHA RC4-SHA ), # just to make sure, that we don't accidentely add bad ciphers above "!EXP !LOW !eNULL !aNULL !DES !MD5 !PSK !SRP" ) ); ========== I have no idea who selected those ciphers, but that list doesn't make any sense. For instance it doesn't contain any DHE ciphers except DSS ciphers which nobody uses. Openssl in Debian also has never disabled TLSv1.2 in either the client or server. Ubuntu did disable it by default I think. This 255 byte limit thing is also being worked around by having an option that sends more than 512 bytes. If you really want to specify some cipher list, can I suggest you either go for something simple as: ALL:!eNULL:!aNULL:!EXPORT:!LOW:!PSK:!SRP:!kDH:+RC4 Or go with one of the suggestions from bettercrypto.org. Kurt
--- End Message ---
--- Begin Message ---Source: libio-socket-ssl-perl Source-Version: 2.027-1 We believe that the bug you reported is fixed in the latest version of libio-socket-ssl-perl, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to [email protected], and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Salvatore Bonaccorso <[email protected]> (supplier of updated libio-socket-ssl-perl package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing [email protected]) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 21 Apr 2016 09:48:38 +0200 Source: libio-socket-ssl-perl Binary: libio-socket-ssl-perl Architecture: source Version: 2.027-1 Distribution: unstable Urgency: medium Maintainer: Debian Perl Group <[email protected]> Changed-By: Salvatore Bonaccorso <[email protected]> Closes: 770399 Description: libio-socket-ssl-perl - Perl module implementing object oriented interface to SSL sockets Changes: libio-socket-ssl-perl (2.027-1) unstable; urgency=medium . * Import upstream version 2.026 and 2.027 - Updates default server an client ciphers based on recommendation of Mozilla and what the current browsers use (Closes: #770399) * Declare compliance with Debian policy 3.9.8 Checksums-Sha1: be5332f46ddfb30fc15c4d4580b499a0881fb934 2599 libio-socket-ssl-perl_2.027-1.dsc 7c5e95027a577a7adeae5030b51606a5de4132ff 210470 libio-socket-ssl-perl_2.027.orig.tar.gz 8144cb78f103a5a63b855983ab5ef4d502090845 9084 libio-socket-ssl-perl_2.027-1.debian.tar.xz Checksums-Sha256: 2c7e3959b06e46103c94acc523467b7c80271495fdf56c601695c7eabd4f6509 2599 libio-socket-ssl-perl_2.027-1.dsc 723517ea71f90105579e7db7a1a2e053bf5c8142a187df8bc1fe3881c3383f67 210470 libio-socket-ssl-perl_2.027.orig.tar.gz a15571e9b3398eb9e0b34fd8200683314bad605f001ba20c146cfaebf3298642 9084 libio-socket-ssl-perl_2.027-1.debian.tar.xz Files: 97c8c6eb482eff9f7f36563a44e56eb4 2599 perl optional libio-socket-ssl-perl_2.027-1.dsc c4dacb943a1ffd35f10217b94547bcdc 210470 perl optional libio-socket-ssl-perl_2.027.orig.tar.gz 25703c6911687d13311145f71a0ce583 9084 perl optional libio-socket-ssl-perl_2.027-1.debian.tar.xz -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJXGIwxAAoJEAVMuPMTQ89E/rcP/2os5CKv2VpDrJ4uJ3Q1i/JU wm/0GI/wAM1wbhYFIPx43pn9AhkrVO/eKDv/Rpdo8CjYZIm1DRTeNTgKqEANqDnd DJ9garJIG5ytoEV4psXsoKYkxxewG0mj8NM6kCq96ApDUaWnoxp8rsbNzgLXJ7ch S4+FslvuSJuPAZYV9kthkmiSSsSGUbCFUZXW/9jmZE+zu25P7U0Dd7dI7Ka9pCFh 23keheguILMogLFxcR5eaH8I5UyxdhAdba4Gz+JJfyA2wV7CLTQrMuqjQxEZSkS/ cKYBPNdEMluc04z+lKG+Ji0RqNhz8K/wwRcNPMrx/BcfHr6Is6JmKe0Pxq2Wk0De bWj1f3dCiDd/uXf7Db29GEN/dLdMbqPvuH7HkNXwAnIphswOzX93SKg5hD1Tip98 bCL6+3yC5PhZn9l2vvgZD7OQx3Gtu4/vptn/htKvS8L5vJPjlwGSOwh+zhPnq4s6 6kX9GlsvSpwrFHajk2LS3lbq1TzPhwuxMDvpwUkvdEzjQL3jBTbyyMFqNf34022J 1/TnbGBzXxX1zEKdWTamV1DxiH+1BB9tVrM+7PZv4DAaCqxAQwCG+BlOC1o+kPWJ P/V4yMOPvQOpzG78/9f6FfeOvXLnV9YzCvZHS6lMjJH/YNq9BUUSugoL9AfqK7wu QjxnIxHVzCHonWcth7Y7 =C91T -----END PGP SIGNATURE-----
--- End Message ---
