From f969280a56ae045e256f427984c67796dc6282301b589adbb1e88e8c3ed1301b Mon Sep 17 00:00:00 2001
From: Petr Gajdos <pgajdos@suse.com>
Date: Wed, 12 Aug 2015 07:21:37 +0000
Subject: [PATCH 1/2] Accepting request 321967 from
 home:kstreitova:branches:Apache

- fix Logjam vulnerability (follows the https://weakdh.org/sysadmin.html guide)
  Change SSLCipherSuite cipherstring to disable export cipher suites
  and deploy Ephemeral Elliptic-Curve Diffie-Hellman (ECDHE) ciphers.
  Adjust 'gensslcert' script to generate a strong and unique Diffie
  Hellman Group and append it to the server certificate file
  [bnc#931723], [CVE-2015-4000]

OBS-URL: https://build.opensuse.org/request/show/321967
OBS-URL: https://build.opensuse.org/package/show/Apache/apache2?expand=0&rev=458
---
 apache2-ssl-global.conf | 3 +--
 apache2.changes         | 9 +++++++++
 gensslcert              | 3 +++
 3 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/apache2-ssl-global.conf b/apache2-ssl-global.conf
index 4ee1a02..4896cb7 100644
--- a/apache2-ssl-global.conf
+++ b/apache2-ssl-global.conf
@@ -77,8 +77,7 @@
 	#   SSL Cipher Suite:
 	#   List the ciphers that the client is permitted to negotiate.
 	#   See the mod_ssl documentation for a complete list.
-        #   https://community.qualys.com/blogs/securitylabs/2013/08/05/configuring-apache-nginx-and-openssl-for-forward-secrecy
-	SSLCipherSuite EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS
+        SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
 
 	#   SSLHonorCipherOrder
 	#   If SSLHonorCipherOrder is disabled, then the client's preferences
diff --git a/apache2.changes b/apache2.changes
index 6ae8582..bfc8879 100644
--- a/apache2.changes
+++ b/apache2.changes
@@ -1,3 +1,12 @@
+-------------------------------------------------------------------
+Tue Aug 11 15:52:42 UTC 2015 - kstreitova@suse.com
+
+- fix Logjam vulnerability: change SSLCipherSuite cipherstring to 
+  disable export cipher suites and deploy Ephemeral Elliptic-Curve
+  Diffie-Hellman (ECDHE) ciphers. Adjust 'gensslcert' script to 
+  generate a strong and unique Diffie Hellman Group and append it
+  to the server certificate file [bnc#931723], [CVE-2015-4000] 
+
 -------------------------------------------------------------------
 Wed Jul 29 06:22:59 UTC 2015 - pgajdos@suse.com
 
diff --git a/gensslcert b/gensslcert
index 9f8916d..020f1ac 100644
--- a/gensslcert
+++ b/gensslcert
@@ -193,6 +193,9 @@ if [ $? -ne 0 ]; then
     myexit $LINENO $?
 fi
 
+echo;myecho generating dhparams and appending it to the server certificate file...
+openssl dhparam 2048  >> $sslcrtdir/${name}server.crt
+
 
 exit 0
 

From 03bf97c804b90824159491d0dc55d386cdbf78737223c4d27fc2a0bcad07aa29 Mon Sep 17 00:00:00 2001
From: Petr Gajdos <pgajdos@suse.com>
Date: Thu, 13 Aug 2015 14:24:27 +0000
Subject: [PATCH 2/2] Accepting request 322437 from home:Andreas_Schwab:Factory

- Fixup libdir in installed files

OBS-URL: https://build.opensuse.org/request/show/322437
OBS-URL: https://build.opensuse.org/package/show/Apache/apache2?expand=0&rev=459
---
 apache2.changes | 5 +++++
 apache2.spec    | 7 +++++++
 2 files changed, 12 insertions(+)

diff --git a/apache2.changes b/apache2.changes
index bfc8879..a06a308 100644
--- a/apache2.changes
+++ b/apache2.changes
@@ -1,3 +1,8 @@
+-------------------------------------------------------------------
+Thu Aug 13 13:04:00 UTC 2015 - schwab@suse.de
+
+- Fixup libdir in installed files
+
 -------------------------------------------------------------------
 Tue Aug 11 15:52:42 UTC 2015 - kstreitova@suse.com
 
diff --git a/apache2.spec b/apache2.spec
index 453a99d..e04a974 100644
--- a/apache2.spec
+++ b/apache2.spec
@@ -578,6 +578,13 @@ cat > %{buildroot}/%{sysconfdir}/uid.conf <<-EOF
 	Group %{httpdgroup}
 EOF
 
+# fixup libdir
+%if "%{_lib}" != "lib64"
+sed -e 's/lib64/%{_lib}/' -i \
+  %{buildroot}/%{sysconfdir}/loadmodule.conf \
+  %{buildroot}/%{_var}/adm/fillup-templates/sysconfig.%{name}
+%endif
+
 # remove configuration for mpms which have not been built
 mpm_confs="$(awk '/IfModule .*\.c/ {print $2}' %{buildroot}/%{sysconfdir}/server-tuning.conf | cut -d. -f1 | tr '\n' ' ')"
 for mpm_conf in $mpm_confs; do