Re: BEAST to be patched in NSS

2013-10-21 Thread Eric H. Christensen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Fri, Oct 18, 2013 at 09:49:29PM +0200, Miloslav Trmač wrote: On Wed, Oct 16, 2013 at 11:46 PM, Elio Maldonado emald...@redhat.com wrote: No one in the NSS team was consulted on this. I usually monitor the FESCO meetings announcements but

Re: BEAST to be patched in NSS

2013-10-21 Thread Miloslav Trmač
Hello, On Sat, Oct 19, 2013 at 5:23 PM, Elio Maldonado Batiz emald...@redhat.com wrote: On 10/18/2013 06:54 PM, Elio Maldonado Batiz wrote: On 10/18/2013 12:55 PM, Miloslav Trmač wrote: On Wed, Oct 16, 2013 at 10:33 PM, Eric H. Christensen spa...@fedoraproject.org wrote: Information on

Re: BEAST to be patched in NSS

2013-10-19 Thread Elio Maldonado Batiz
On 10/18/2013 06:54 PM, Elio Maldonado Batiz wrote: On 10/18/2013 12:55 PM, Miloslav Trmač wrote: On Wed, Oct 16, 2013 at 10:33 PM, Eric H. Christensen spa...@fedoraproject.org wrote: Information on this fix is in Bugzilla[1]. There are 80 packages affected, would it be possible to give the

Re: BEAST to be patched in NSS

2013-10-18 Thread Miloslav Trmač
On Wed, Oct 16, 2013 at 11:46 PM, Elio Maldonado emald...@redhat.com wrote: No one in the NSS team was consulted on this. I usually monitor the FESCO meetings announcements but missed this. I try to make sure that the relevant maintainers are always Cc:ed on the fesco tickets, I have missed

Re: BEAST to be patched in NSS

2013-10-18 Thread Miloslav Trmač
On Wed, Oct 16, 2013 at 10:33 PM, Eric H. Christensen spa...@fedoraproject.org wrote: Information on this fix is in Bugzilla[1]. There are 80 packages affected, would it be possible to give the owners a shorter (and authoritative[1]) version, instead of asking each maintainer to fish the

Re: BEAST to be patched in NSS

2013-10-18 Thread Elio Maldonado Batiz
On 10/18/2013 12:55 PM, Miloslav Trmač wrote: On Wed, Oct 16, 2013 at 10:33 PM, Eric H. Christensen spa...@fedoraproject.org wrote: Information on this fix is in Bugzilla[1]. There are 80 packages affected, would it be possible to give the owners a shorter (and authoritative[1]) version,

Re: BEAST to be patched in NSS

2013-10-17 Thread Elio Maldonado Batiz
On 10/16/2013 08:54 PM, Simo Sorce wrote: On Wed, 2013-10-16 at 19:08 -0700, Elio Maldonado Batiz wrote: Oops, I pasted too much is hard to read. The diff lines that matter are # This patch is currently meant for stable branches -# Patch29: nss-ssl-cbc-random-iv-off-by-default.patch

BEAST to be patched in NSS

2013-10-16 Thread Eric H. Christensen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 FESCo met today to address the NSS BEAST patch that left all software using NSS vulnerable to the BEAST[0] vulnerability. The decision was made to implement the patch that fixes this vulnerablity in F19 and F20. There are some programs that may

Re: BEAST to be patched in NSS

2013-10-16 Thread Elio Maldonado
- Original Message - From: Eric H. Christensen spa...@fedoraproject.org To: devel-annou...@lists.fedoraproject.org Sent: Wednesday, October 16, 2013 1:33:06 PM Subject: BEAST to be patched in NSS -BEGIN PGP SIGNED MESSAGE- Hash: SHA512 FESCo met today to address the NSS BEAST

Re: BEAST to be patched in NSS

2013-10-16 Thread Elio Maldonado Batiz
Subject: BEAST to be patched in NSS -BEGIN PGP SIGNED MESSAGE- Hash: SHA512 FESCo met today to address the NSS BEAST patch that left all software using NSS vulnerable to the BEAST[0] vulnerability. The decision was made to implement the patch that fixes this vulnerablity in F19 and F20

Re: BEAST to be patched in NSS

2013-10-16 Thread Simo Sorce
On Wed, 2013-10-16 at 19:08 -0700, Elio Maldonado Batiz wrote: Oops, I pasted too much is hard to read. The diff lines that matter are # This patch is currently meant for stable branches -# Patch29: nss-ssl-cbc-random-iv-off-by-default.patch +Patch29: