pool/apache2
SHA256
4
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Accepting request 321967 from home:kstreitova:branches:Apache

Browse Source 
- fix Logjam vulnerability (follows the https://weakdh.org/sysadmin.html guide)
  Change SSLCipherSuite cipherstring to disable export cipher suites
  and deploy Ephemeral Elliptic-Curve Diffie-Hellman (ECDHE) ciphers.
  Adjust 'gensslcert' script to generate a strong and unique Diffie
  Hellman Group and append it to the server certificate file
  [bnc#931723], [CVE-2015-4000]

OBS-URL: https://build.opensuse.org/request/show/321967
OBS-URL: https://build.opensuse.org/package/show/Apache/apache2?expand=0&rev=458
This commit is contained in:
Petr Gajdos 2015-08-12 07:21:37 +00:00 committed by Git OBS Bridge
parent 2e2a6b9dc1
commit f969280a56
3 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
apache2-ssl-global.conf
View File

@ -77,8 +77,7 @@
# SSL Cipher Suite:
# List the ciphers that the client is permitted to negotiate.
# See the mod_ssl documentation for a complete list.
# https://community.qualys.com/blogs/securitylabs/2013/08/05/configuring-apache-nginx-and-openssl-for-forward-secrecy
SSLCipherSuite EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
# SSLHonorCipherOrder
# If SSLHonorCipherOrder is disabled, then the client's preferences

9
apache2.changes
View File

@ -1,3 +1,12 @@
-------------------------------------------------------------------
Tue Aug 11 15:52:42 UTC 2015 - kstreitova@suse.com
- fix Logjam vulnerability: change SSLCipherSuite cipherstring to
disable export cipher suites and deploy Ephemeral Elliptic-Curve
Diffie-Hellman (ECDHE) ciphers. Adjust 'gensslcert' script to
generate a strong and unique Diffie Hellman Group and append it
to the server certificate file [bnc#931723], [CVE-2015-4000]
-------------------------------------------------------------------
Wed Jul 29 06:22:59 UTC 2015 - pgajdos@suse.com

3
gensslcert
View File

@ -193,6 +193,9 @@ if [ $? -ne 0 ]; then
myexit $LINENO $?
fi
echo;myecho generating dhparams and appending it to the server certificate file...
openssl dhparam 2048 >> $sslcrtdir/${name}server.crt
exit 0