[Bug 1383379] Re: nginx default config has SSLv3 enabled, makes sites using default config options vulnerable to POODLE
Fixed in latest NGINX upload to the PPAs. ** Changed in: nginx Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to nginx in Ubuntu. https://bugs.launchpad.net/bugs/1383379 Title: nginx default config has SSLv3 enabled, makes sites using default config options vulnerable to POODLE To manage notifications about this bug go to: https://bugs.launchpad.net/nginx/+bug/1383379/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1383379] Re: nginx default config has SSLv3 enabled, makes sites using default config options vulnerable to POODLE
** Also affects: nginx (Ubuntu Precise) Importance: Undecided Status: New ** Also affects: nginx (Ubuntu Trusty) Importance: Undecided Status: New ** Also affects: nginx (Ubuntu Utopic) Importance: Undecided Status: New ** Changed in: nginx (Ubuntu Utopic) Status: New => Fix Released -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to nginx in Ubuntu. https://bugs.launchpad.net/bugs/1383379 Title: nginx default config has SSLv3 enabled, makes sites using default config options vulnerable to POODLE To manage notifications about this bug go to: https://bugs.launchpad.net/nginx/+bug/1383379/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1383379] Re: nginx default config has SSLv3 enabled, makes sites using default config options vulnerable to POODLE
(nginx project) Updated packages uploaded to the staging PPA, pending building. ** Changed in: nginx Status: In Progress => Fix Committed -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to nginx in Ubuntu. https://bugs.launchpad.net/bugs/1383379 Title: nginx default config has SSLv3 enabled, makes sites using default config options vulnerable to POODLE To manage notifications about this bug go to: https://bugs.launchpad.net/nginx/+bug/1383379/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1383379] Re: nginx default config has SSLv3 enabled, makes sites using default config options vulnerable to POODLE
The attachment "Precise Debdiff for Ubuntu" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team. [This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.] ** Tags added: patch -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to nginx in Ubuntu. https://bugs.launchpad.net/bugs/1383379 Title: nginx default config has SSLv3 enabled, makes sites using default config options vulnerable to POODLE To manage notifications about this bug go to: https://bugs.launchpad.net/nginx/+bug/1383379/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1383379] Re: nginx default config has SSLv3 enabled, makes sites using default config options vulnerable to POODLE
** Patch added: "Trusty Debdiff for Ubuntu" https://bugs.launchpad.net/nginx/+bug/1383379/+attachment/4241832/+files/nginx_sslv3_remove_debdiff_trusty.debdiff -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to nginx in Ubuntu. https://bugs.launchpad.net/bugs/1383379 Title: nginx default config has SSLv3 enabled, makes sites using default config options vulnerable to POODLE To manage notifications about this bug go to: https://bugs.launchpad.net/nginx/+bug/1383379/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1383379] Re: nginx default config has SSLv3 enabled, makes sites using default config options vulnerable to POODLE
NOTE: I didn't know where to target this for Utopic, so I just targeted it to 'utopic'. Please change that if it is not valid. ** Patch added: "Utopic Debdiff for Ubuntu" https://bugs.launchpad.net/nginx/+bug/1383379/+attachment/4241835/+files/nginx_sslv3_remove_debdiff_utopic.debdiff ** Changed in: nginx Status: Confirmed => In Progress -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to nginx in Ubuntu. https://bugs.launchpad.net/bugs/1383379 Title: nginx default config has SSLv3 enabled, makes sites using default config options vulnerable to POODLE To manage notifications about this bug go to: https://bugs.launchpad.net/nginx/+bug/1383379/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1383379] Re: nginx default config has SSLv3 enabled, makes sites using default config options vulnerable to POODLE
** Patch added: "Precise Debdiff for Ubuntu" https://bugs.launchpad.net/nginx/+bug/1383379/+attachment/4241830/+files/nginx_sslv3_remove_debdiff_precise.debdiff -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to nginx in Ubuntu. https://bugs.launchpad.net/bugs/1383379 Title: nginx default config has SSLv3 enabled, makes sites using default config options vulnerable to POODLE To manage notifications about this bug go to: https://bugs.launchpad.net/nginx/+bug/1383379/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1383379] Re: nginx default config has SSLv3 enabled, makes sites using default config options vulnerable to POODLE
In discussion with mdeslaur on IRC, I'm attaching DebDiffs for Ubuntu in the off chance the release team wishes to push these changes. A few extra details as to why this is extremely relevant to being pushed and updated: A lot of newbie users that we see in the NGINX IRC channel for support end up using the default configuration file(s) as a template/law for their sites, and we end up seeing them just uncomment the SSL portion and use it. That opens them up to the POODLE vulnerability. Upstream, in Debian, this was revised per POODLE so newbies wouldn't be exposing themselves to vulnerability, hence the rationale for this perhaps being pushed/updated. Unfortunately, all versions of nginx (including Lucid, which is being ignored intentionally) are impacted by POODLE and SSLv3, so it's better to just remove the SSLv3 protocol from the ssl_protocols line, mainly to prevent newbies from making their systems open to attack. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to nginx in Ubuntu. https://bugs.launchpad.net/bugs/1383379 Title: nginx default config has SSLv3 enabled, makes sites using default config options vulnerable to POODLE To manage notifications about this bug go to: https://bugs.launchpad.net/nginx/+bug/1383379/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1383379] Re: nginx default config has SSLv3 enabled, makes sites using default config options vulnerable to POODLE
** Tags added: poodle -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to nginx in Ubuntu. https://bugs.launchpad.net/bugs/1383379 Title: nginx default config has SSLv3 enabled, makes sites using default config options vulnerable to POODLE To manage notifications about this bug go to: https://bugs.launchpad.net/nginx/+bug/1383379/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1383379] Re: nginx default config has SSLv3 enabled, makes sites using default config options vulnerable to POODLE
** Description changed: The included `default` config file contains a commented-out section for SSL. That SSL section has the SSLv3 parameter provided for `ssl_protocols`. This means that systems are vulnerable to SSLv3 and the POODLE vulnerability. Can we remove that from the default section, even though it's commented out, so users don't use the insecure SSLv3 protocol anymore? -- In the PPAs, this affects all versions of the package in both Stable and Mainline. In Ubuntu, this affects the Precise, Trusty, and Utopic versions of the package. + + This change was already made in Debian Unstable. ** Description changed: The included `default` config file contains a commented-out section for SSL. That SSL section has the SSLv3 parameter provided for `ssl_protocols`. This means that systems are vulnerable to SSLv3 and the POODLE vulnerability. Can we remove that from the default section, even though it's commented out, so users don't use the insecure SSLv3 protocol anymore? -- - In the PPAs, this affects all versions of the package in both Stable and - Mainline. + NGINX Project: + In the PPAs, this affects all versions of the package in both Stable and Mainline. + + -- + + Ubuntu Project: In Ubuntu, this affects the Precise, Trusty, and Utopic versions of the package. - This change was already made in Debian Unstable. + This change was already made/committed in Debian Unstable. ** Also affects: nginx (Ubuntu) Importance: Undecided Status: New ** Changed in: nginx Assignee: (unassigned) => Thomas Ward (teward) -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to nginx in Ubuntu. https://bugs.launchpad.net/bugs/1383379 Title: nginx default config has SSLv3 enabled, makes sites using default config options vulnerable to POODLE To manage notifications about this bug go to: https://bugs.launchpad.net/nginx/+bug/1383379/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
