Your message dated Sat, 06 Sep 2014 09:50:41 +0000 with message-id <[email protected]> and subject line Bug#747673: fixed in ejabberd 14.07-1 has caused the Debian Bug report #747673, regarding Horrid default cipher settings without option to adjust them to sane values to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 747673: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=747673 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---Package: ejabberd Version: 2.1.11-1 Severity: grave Tags: security When setting up ejabberd with a default configuration it allows only connections with a weak SSL configuration - if this is even configured: 1. By default ejabberd allows SSLv3 which is broken in various ways and thus should no longer be used. 2. By default ejabberd uses weak cipher suites that make use of weak primitives like DES, RC2, RC4, MD5, export ciphers. 3. By default ejabberd does not provide ANY ciphers that make use of forward secrecy and thus jeopardizes the communication of users that crossed this server in case of a private key compromise. 4. Most importantly ejabberd does not provide any way to adjust the accepted security parameters (acceptable protocol versions, cipher string, cipher ordering, used ECC curves, used ECDHE/DHE parameters) Please make sure that a default configuration can be configured to use strong cryptography, using non-broken primitives and does so by default. Kind regards, Benny Baumann P.S.: By courtesy of #747453. -- System Information: Debian Release: jessie/sid APT prefers testing APT policy: (900, 'testing'), (800, 'stable'), (750, 'experimental'), (700, 'unstable'), (500, 'oldstable') Architecture: amd64 (x86_64) Kernel: Linux 3.13-1-amd64 (SMP w/8 CPU cores) Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Versions of packages ejabberd depends on: ii adduser 3.113+nmu3 ii debconf [debconf-2.0] 1.5.53 ii erlang-asn1 1:17.0-dfsg-1 ii erlang-base [erlang-abi-15.b] 1:17.0-dfsg-1 ii erlang-crypto 1:17.0-dfsg-1 ii erlang-inets 1:17.0-dfsg-1 ii erlang-mnesia 1:17.0-dfsg-1 ii erlang-odbc 1:17.0-dfsg-1 ii erlang-public-key 1:17.0-dfsg-1 ii erlang-ssl 1:17.0-dfsg-1 ii erlang-syntax-tools 1:17.0-dfsg-1 ii libc6 2.18-5 ii libexpat1 2.1.0-4 ii libpam0g 1.1.8-3 ii libssl1.0.0 1.0.1g-3 ii openssl 1.0.1g-3 ii ucf 3.0028 ii zlib1g 1:1.2.8.dfsg-1 ejabberd recommends no packages. Versions of packages ejabberd suggests: ii imagemagick 8:6.7.7.10+dfsg-1 ii libunix-syslog-perl 1.1-2+b3 -- debconf information excluded
--- End Message ---
--- Begin Message ---Source: ejabberd Source-Version: 14.07-1 We believe that the bug you reported is fixed in the latest version of ejabberd, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to [email protected], and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Philipp Huebner <[email protected]> (supplier of updated ejabberd package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing [email protected]) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 30 Aug 2014 01:40:09 +0200 Source: ejabberd Binary: ejabberd Architecture: source amd64 Version: 14.07-1 Distribution: unstable Urgency: low Maintainer: Konstantin Khomoutov <[email protected]> Changed-By: Philipp Huebner <[email protected]> Description: ejabberd - distributed, fault-tolerant Jabber/XMPP server written in Erlang Closes: 503313 517178 539409 598332 610532 706897 712145 722478 737762 738496 744084 746029 746043 746073 747673 757858 Changes: ejabberd (14.07-1) unstable; urgency=low . * New upstream release (Closes: #503313, #539409, #610532, #706897, #712145, #722478, #746029, #746043, 746073, #747673) * Change default EJABBERD_NODE back to "ejabberd" (Closes: #757858) * Suppress misleading warning during postinst (Closes: #598332) * Declare package source format as 3.0 (quilt) * Switch to debhelper 9 * Drop obsolete patches for older releases * Add new patches to make 14.07 build and work * Drop custom scripts in favour of upstream ones * Drop custom config+init in favour of upstream ones (Closes: #744084, #517178, #738496) * Adjust packaging to new upstream release * Update (Build-)Depends and Standards-Version * Update copyright * Update maintainer scripts * Update TODO * Update NEWS * Fix watch file * Clean up packaging * Add Provides: xmpp-server to debian/control (Closes: #737762) Checksums-Sha1: ff779cce3e0ab6d53ea7f802ba81256f583dec9a 2405 ejabberd_14.07-1.dsc 4e6a6769f7a47fce8fe326d407179f23c76110ff 3191122 ejabberd_14.07.orig.tar.gz fa4d657b52aae6e75c72e0460e7e0f69ba619811 47332 ejabberd_14.07-1.debian.tar.xz 0cc12a9af6f7d386fccb7c23c48b86ec1cd37284 4149746 ejabberd_14.07-1_amd64.deb Checksums-Sha256: 6a2ae12e49cf255d8e92cc83b0a648db87b03aceee434c0e08fac6621271acb8 2405 ejabberd_14.07-1.dsc d8002aac827d5c23870f2b39f8e0c07c2f7c21491c416886d905b92a0395789b 3191122 ejabberd_14.07.orig.tar.gz f4839a5b1c127fcbfcc7b6a338c3b41877b946e2b435d115f226d2db0fa02655 47332 ejabberd_14.07-1.debian.tar.xz 8d75613f4c323e7dd08195e8ba0e802158195178716db6b72d1cbcd88d42b83c 4149746 ejabberd_14.07-1_amd64.deb Files: fcec4cb6718e4570c265b7317325af7e 4149746 net optional ejabberd_14.07-1_amd64.deb 51275a5724db90d7dbb5f4790deb520c 2405 net optional ejabberd_14.07-1.dsc 5bcdb72b6812b2b6736a86d7cdec22cf 3191122 net optional ejabberd_14.07.orig.tar.gz 23b0937dd10d3bffa6d039a35a69e97f 47332 net optional ejabberd_14.07-1.debian.tar.xz -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJUCtb+AAoJEOXKjEkl5CBfgy0P/0NaA/OTooSpJ4uhz6cHtYVq R+FS9w36hkbY1bukQD+HxfuOxCqJKaVZl9Wa51YglJfffoOsJD7uSk/M6pb9c4Jn 7/QCUjPl3l/IhhRna1u4oKgoAYpDCZXP+f7o7FkxsrqS6t8cimQcGE6+kSS9LXg4 FDVT5YtPVxYoOACv7QWX4NftFMW2CgFcHYMUM4gs1U1HOi8hWN1l8Ix7DYutsciK c35rxzChWzkR6mDmJIl7uGdKY7VFItJYC2KNP4fL5r/ESSf2P/Stx/JbCWDWJeBI nQ8+NuwwABDD62jr8E61eEqEMXLOEnMc1UYG0AMhwIrkCLqC+gmHz1mQpVerkUfc a+wsad6iYd/FCPCZYM2JmprYsvLNeQPpP09Bzd0Xd4fp6WnTMWdcWqi+pTi3EOnx k/gEsSwZ1m1EUgEBmOw4/EUKFIjvcJA9NufZu60Yf/rMf4ofQanNMqjk2xkebVM+ zTwePUegN5tfymwcEeoiKtLrEkfDqkZHF3aGEVv78RFrJ1b5uojR+0uiD9DIvNd/ GR+iNzS4Jfh8Ujt1kaww73uYhsFDecmIv4gi1uDfNFJcnlYjaL98CQMV2DlQqV5A iZX/H61YE+yssiOx09I0DWZCDUYaq3kVq5KUPsMjpoujIKHchFPeQ1/Gg6UmgtFD egwLKQ84z6FXjwjFYJ0k =hycj -----END PGP SIGNATURE-----
--- End Message ---
