Security update for apache2-mod_nss SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:2329-1 Final 1 1 2016-09-16T15:19:20Z current 2016-09-16T15:19:20Z 2016-09-16T15:19:20Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for apache2-mod_nss This update provides apache2-mod_nss 1.0.14, which brings several fixes and enhancements: - SHA256 cipher names change spelling from *_sha256 to *_sha_256. - Drop mod_nss_migrate.pl and use upstream migrate script instead. - Check for Apache user owner/group read permissions of NSS database at startup. - Update default ciphers to something more modern and secure. - Check for host and netstat commands in gencert before trying to use them. - Don't ignore NSSProtocol when NSSFIPS is enabled. - Use proper shell syntax to avoid creating /0 in gencert. - Add server support for DHE ciphers. - Extract SAN from server/client certificates into env. - Fix memory leaks and other coding issues caught by clang analyzer. - Add support for Server Name Indication (SNI) - Add support for SNI for reverse proxy connections. - Add RenegBufferSize? option. - Add support for TLS Session Tickets (RFC 5077). - Implement a slew more OpenSSL cipher macros. - Fix a number of illegal memory accesses and memory leaks. - Support for SHA384 ciphers if they are available in the version of NSS mod_nss is built against. - Add the SECURE_RENEG environment variable. - Add some hints when NSS database cannot be initialized. - Code cleanup including trailing whitespace and compiler warnings. - Modernize autotools configuration slightly, add config.h. - Add small test suite for SNI. - Add compatibility for mod_ssl-style cipher definitions. - Add Camelia ciphers. - Remove Fortezza ciphers. - Add TLSv1.2-specific ciphers. - Initialize cipher list when re-negotiating handshake. - Completely remove support for SSLv2. - Add support for sqlite NSS databases. - Compare subject CN and VS hostname during server start up. - Add support for enabling TLS v1.2. - Don't enable SSL 3 by default. (CVE-2014-3566) - Improve protocol testing. - Add nss_pcache man page. - Fix argument handling in nss_pcache. - Support httpd 2.4+. - Allow users to configure a helper to ask for certificate passphrases via NSSPassPhraseDialog. (bsc#975394) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sleclo50sp3-apache2-mod_nss-12751,sleman21-apache2-mod_nss-12751,slemap21-apache2-mod_nss-12751,sleposp3-apache2-mod_nss-12751,slessp2-apache2-mod_nss-12751,slessp3-apache2-mod_nss-12751,slessp4-apache2-mod_nss-12751 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20162329-1/ Link for SUSE-SU-2016:2329-1 https://lists.suse.com/pipermail/sle-security-updates/2016-September/002277.html E-Mail link for SUSE-SU-2016:2329-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/975394 SUSE Bug 975394 https://bugzilla.suse.com/979688 SUSE Bug 979688 https://www.suse.com/security/cve/CVE-2013-4566/ SUSE CVE CVE-2013-4566 page https://www.suse.com/security/cve/CVE-2014-3566/ SUSE CVE CVE-2014-3566 page SUSE Linux Enterprise Point of Sale 11 SP3 SUSE Linux Enterprise Server 11 SP2-LTSS SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Manager 2.1 SUSE Manager Proxy 2.1 SUSE OpenStack Cloud 5 apache2-mod_nss-1.0.14-0.4.25.1 apache2-mod_nss-1.0.14-0.4.25.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 apache2-mod_nss-1.0.14-0.4.25.1 as a component of SUSE Linux Enterprise Server 11 SP2-LTSS apache2-mod_nss-1.0.14-0.4.25.1 as a component of SUSE Linux Enterprise Server 11 SP3-LTSS apache2-mod_nss-1.0.14-0.4.25.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA apache2-mod_nss-1.0.14-0.4.25.1 as a component of SUSE Linux Enterprise Server 11 SP4 apache2-mod_nss-1.0.14-0.4.25.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 apache2-mod_nss-1.0.14-0.4.25.1 as a component of SUSE Manager 2.1 apache2-mod_nss-1.0.14-0.4.25.1 as a component of SUSE Manager Proxy 2.1 apache2-mod_nss-1.0.14-0.4.25.1 as a component of SUSE OpenStack Cloud 5 mod_nss 1.0.8 and earlier, when NSSVerifyClient is set to none for the server/vhost context, does not enforce the NSSVerifyClient setting in the directory context, which allows remote attackers to bypass intended access restrictions. CVE-2013-4566 SUSE Linux Enterprise Point of Sale 11 SP3:apache2-mod_nss-1.0.14-0.4.25.1 SUSE Linux Enterprise Server 11 SP2-LTSS:apache2-mod_nss-1.0.14-0.4.25.1 SUSE Linux Enterprise Server 11 SP3-LTSS:apache2-mod_nss-1.0.14-0.4.25.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:apache2-mod_nss-1.0.14-0.4.25.1 SUSE Linux Enterprise Server 11 SP4:apache2-mod_nss-1.0.14-0.4.25.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:apache2-mod_nss-1.0.14-0.4.25.1 SUSE Manager 2.1:apache2-mod_nss-1.0.14-0.4.25.1 SUSE Manager Proxy 2.1:apache2-mod_nss-1.0.14-0.4.25.1 SUSE OpenStack Cloud 5:apache2-mod_nss-1.0.14-0.4.25.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162329-1/ https://www.suse.com/security/cve/CVE-2013-4566.html CVE-2013-4566 https://bugzilla.suse.com/853039 SUSE Bug 853039 The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue. CVE-2014-3566 SUSE Linux Enterprise Point of Sale 11 SP3:apache2-mod_nss-1.0.14-0.4.25.1 SUSE Linux Enterprise Server 11 SP2-LTSS:apache2-mod_nss-1.0.14-0.4.25.1 SUSE Linux Enterprise Server 11 SP3-LTSS:apache2-mod_nss-1.0.14-0.4.25.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:apache2-mod_nss-1.0.14-0.4.25.1 SUSE Linux Enterprise Server 11 SP4:apache2-mod_nss-1.0.14-0.4.25.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:apache2-mod_nss-1.0.14-0.4.25.1 SUSE Manager 2.1:apache2-mod_nss-1.0.14-0.4.25.1 SUSE Manager Proxy 2.1:apache2-mod_nss-1.0.14-0.4.25.1 SUSE OpenStack Cloud 5:apache2-mod_nss-1.0.14-0.4.25.1 critical 5.8 AV:N/AC:M/Au:N/C:N/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162329-1/ https://www.suse.com/security/cve/CVE-2014-3566.html CVE-2014-3566 https://bugzilla.suse.com/1011293 SUSE Bug 1011293 https://bugzilla.suse.com/1031023 SUSE Bug 1031023 https://bugzilla.suse.com/901223 SUSE Bug 901223 https://bugzilla.suse.com/901254 SUSE Bug 901254 https://bugzilla.suse.com/901277 SUSE Bug 901277 https://bugzilla.suse.com/901748 SUSE Bug 901748 https://bugzilla.suse.com/901757 SUSE Bug 901757 https://bugzilla.suse.com/901759 SUSE Bug 901759 https://bugzilla.suse.com/901889 SUSE Bug 901889 https://bugzilla.suse.com/901968 SUSE Bug 901968 https://bugzilla.suse.com/902229 SUSE Bug 902229 https://bugzilla.suse.com/902233 SUSE Bug 902233 https://bugzilla.suse.com/902476 SUSE Bug 902476 https://bugzilla.suse.com/903405 SUSE Bug 903405 https://bugzilla.suse.com/903684 SUSE Bug 903684 https://bugzilla.suse.com/904889 SUSE Bug 904889 https://bugzilla.suse.com/905106 SUSE Bug 905106 https://bugzilla.suse.com/914041 SUSE Bug 914041 https://bugzilla.suse.com/994144 SUSE Bug 994144