demus/mod_security-rpm
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Change mlogc default SSL algo (RHBZ #1441614)

Browse Source
This commit is contained in:
Athmane Madjoudj 2017-04-26 00:46:39 +01:00
parent f70d5cb5bf
commit d8732e2dd6
2 changed files with 34 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
0001-mlogc-Changes-the-default-SSL-algo-to-TLS-1.2.patch Normal file
View File

@ -0,0 +1,28 @@
From 84f2299f6b3b56cf5342ad378c3641be548bf79c Mon Sep 17 00:00:00 2001
From: Felipe Zimmerle <fcosta@trustwave.com>
Date: Mon, 3 Nov 2014 10:13:21 -0800
Subject: [PATCH] mlogc: Changes the default SSL algo to TLS 1.2
As reported by Josh Amishav-Zlatin, mlogc was making usage of SSLv3 instead of
TLS 1.2. Servers should not answer SSLv3 after poodle.
---
mlogc/mlogc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/mlogc/mlogc.c b/mlogc/mlogc.c
index 4163230..c4b2a23 100644
--- a/mlogc/mlogc.c
+++ b/mlogc/mlogc.c
@@ -1218,8 +1218,8 @@ static void logc_init(void)
curl_easy_setopt(curl, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, FALSE);
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0);
- /* SSLv3 works better overall as some servers have issues with TLS */
- curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_SSLv3);
+ curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_2);
+
curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 15);
curl_easy_setopt(curl, CURLOPT_NOSIGNAL, TRUE);
curl_easy_setopt(curl, CURLOPT_HEADER, TRUE);
--
1.9.1

7
mod_security.spec
View File

@ -10,7 +10,7 @@
Summary: Security module for the Apache HTTP Server
Name: mod_security
Version: 2.7.3
Release: 4%{?dist}
Release: 5%{?dist}
License: ASL 2.0
URL: http://www.modsecurity.org/
Group: System Environment/Daemons
@ -20,6 +20,7 @@ Source2: 10-mod_security.conf
Patch0: mod_security-2.7.3-fix-mem-leak-and-cve-2013-2765.patch
Patch1: mod_security-2.7.6-fix_chunked_string_case_sensitive_issue-cve-2013-5705.patch
Patch2: mod_security-fix-error-500-for-invalid-requests.patch
Patch3: 0001-mlogc-Changes-the-default-SSL-algo-to-TLS-1.2.patch
Requires: httpd httpd-mmn = %{_httpd_mmn}
BuildRequires: httpd-devel libxml2-devel pcre-devel curl-devel lua-devel
@ -43,6 +44,7 @@ This package contains the ModSecurity Audit Log Collector.
%patch0 -p1
%patch1 -p1
%patch2 -p1
%patch3 -p1
%build
%configure --enable-pcre-match-limit=1000000 \
@ -113,6 +115,9 @@ rm -rf %{buildroot}
%endif
%changelog
* Wed Apr 26 2017 Athmane Madjoudj <athmane@fedoraproject.org> - 2.7.3-5
- Change mlogc default SSL algo (RHBZ #1441614)
* Thu Jun 16 2016 Athmane Madjoudj <athmane@fedoraproject.org> - 2.7.3-4
- Add a fix for failing on PUT/POST requests with http 500 error (RHBZ #1344471)