Re: BEAST to be patched in NSS

2013-10-21 Thread Miloslav Trmač
Hello, On Sat, Oct 19, 2013 at 5:23 PM, Elio Maldonado Batiz wrote: > On 10/18/2013 06:54 PM, Elio Maldonado Batiz wrote: >> >> On 10/18/2013 12:55 PM, Miloslav Trmač wrote: >>> >>> On Wed, Oct 16, 2013 at 10:33 PM, Eric H. Christensen >>> wrote: Information on this fix is in Bugzilla[1

Re: BEAST to be patched in NSS

2013-10-21 Thread Eric H. Christensen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Fri, Oct 18, 2013 at 09:49:29PM +0200, Miloslav Trmač wrote: > On Wed, Oct 16, 2013 at 11:46 PM, Elio Maldonado wrote: > > No one in the NSS team was consulted on this. I usually monitor the FESCO > > meetings announcements but missed this. > I

Re: BEAST to be patched in NSS

2013-10-19 Thread Elio Maldonado Batiz
On 10/18/2013 06:54 PM, Elio Maldonado Batiz wrote: On 10/18/2013 12:55 PM, Miloslav Trmač wrote: On Wed, Oct 16, 2013 at 10:33 PM, Eric H. Christensen wrote: Information on this fix is in Bugzilla[1]. There are >80 packages affected, would it be possible to give the owners a shorter (and aut

Re: BEAST to be patched in NSS

2013-10-18 Thread Elio Maldonado Batiz
On 10/18/2013 12:55 PM, Miloslav Trmač wrote: On Wed, Oct 16, 2013 at 10:33 PM, Eric H. Christensen wrote: Information on this fix is in Bugzilla[1]. There are >80 packages affected, would it be possible to give the owners a shorter (and authoritative[1]) version, instead of asking each mainta

Re: BEAST to be patched in NSS

2013-10-18 Thread Miloslav Trmač
On Wed, Oct 16, 2013 at 10:33 PM, Eric H. Christensen wrote: > Information on this fix is in Bugzilla[1]. There are >80 packages affected, would it be possible to give the owners a shorter (and authoritative[1]) version, instead of asking each maintainer to fish the information out of a bug with

Re: BEAST to be patched in NSS

2013-10-18 Thread Miloslav Trmač
On Wed, Oct 16, 2013 at 11:46 PM, Elio Maldonado wrote: > No one in the NSS team was consulted on this. I usually monitor the FESCO > meetings announcements but missed this. I try to make sure that the relevant maintainers are always Cc:ed on the fesco tickets, I have missed this one. I'm sorry.

Re: BEAST to be patched in NSS

2013-10-17 Thread Elio Maldonado Batiz
On 10/16/2013 08:54 PM, Simo Sorce wrote: On Wed, 2013-10-16 at 19:08 -0700, Elio Maldonado Batiz wrote: Oops, I pasted too much is hard to read. The diff lines that matter are # This patch is currently meant for stable branches -# Patch29: nss-ssl-cbc-random-iv-off-by-default.patch

Re: BEAST to be patched in NSS

2013-10-16 Thread Simo Sorce
On Wed, 2013-10-16 at 19:08 -0700, Elio Maldonado Batiz wrote: > Oops, I pasted too much is hard to read. The diff lines that matter > are > > # This patch is currently meant for stable branches > -# Patch29: nss-ssl-cbc-random-iv-off-by-default.patch > +Patch29: nss-ssl-cbc-ran

Re: BEAST to be patched in NSS

2013-10-16 Thread Elio Maldonado Batiz
variable NSS_SSL_CBC_RANDOM_IV=0. ... -Elio On Wed, Oct 16, 2013 at 2:46 PM, Elio Maldonado wrote: > > > - Original Message - > From: "Eric H. Christensen" > To: devel-annou...@lists.fedoraproject.org > Sent: Wednesday, October 16, 2013 1:33:06 PM > Subj

Re: BEAST to be patched in NSS

2013-10-16 Thread Elio Maldonado
- Original Message - From: "Eric H. Christensen" To: devel-annou...@lists.fedoraproject.org Sent: Wednesday, October 16, 2013 1:33:06 PM Subject: BEAST to be patched in NSS -BEGIN PGP SIGNED MESSAGE- Hash: SHA512 FESCo met today to address the NSS BEAST patch tha

BEAST to be patched in NSS

2013-10-16 Thread Eric H. Christensen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 FESCo met today to address the NSS BEAST patch that left all software using NSS vulnerable to the BEAST[0] vulnerability. The decision was made to implement the patch that fixes this vulnerablity in F19 and F20. There are some programs that may