Security update for apache2-mod_nss SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:2396-1 Final 1 1 2016-09-27T13:12:22Z current 2016-09-27T13:12:22Z 2016-09-27T13:12:22Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for apache2-mod_nss This update provides apache2-mod_nss 1.0.14, which brings several fixes and enhancements: - Fix OpenSSL ciphers stopped parsing at +. (CVE-2016-3099) - Created valgrind suppression files to ease debugging. - Implement SSL_PPTYPE_FILTER to call executables to get the key password pins. - Improvements to migrate.pl. - Update default ciphers to something more modern and secure. - Check for host and netstat commands in gencert before trying to use them. - Add server support for DHE ciphers. - Extract SAN from server/client certificates into env - Fix memory leaks and other coding issues caught by clang analyzer. - Add support for Server Name Indication (SNI). - Add support for SNI for reverse proxy connections. - Add RenegBufferSize? option. - Add support for TLS Session Tickets (RFC 5077). - Fix logical AND support in OpenSSL cipher compatibility. - Correctly handle disabled ciphers. (CVE-2015-5244) - Implement a slew more OpenSSL cipher macros. - Fix a number of illegal memory accesses and memory leaks. - Support for SHA384 ciphers if they are available in NSS. - Add compatibility for mod_ssl-style cipher definitions. - Add TLSv1.2-specific ciphers. - Completely remove support for SSLv2. - Add support for sqlite NSS databases. - Compare subject CN and VS hostname during server start up. - Add support for enabling TLS v1.2. - Don't enable SSL 3 by default. (CVE-2014-3566) - Fix CVE-2013-4566. - Move nss_pcache to /usr/libexec. - Support httpd 2.4+. - SHA256 cipher names change spelling from *_sha256 to *_sha_256. - Use apache2-systemd-ask-pass to prompt for a certificate passphrase. (bsc#972968, bsc#975394) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-SAP-12-2016-1391,SUSE-SLE-SERVER-12-2016-1391 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20162396-1/ Link for SUSE-SU-2016:2396-1 https://lists.suse.com/pipermail/sle-security-updates/2016-September/002292.html E-Mail link for SUSE-SU-2016:2396-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/972968 SUSE Bug 972968 https://bugzilla.suse.com/975394 SUSE Bug 975394 https://bugzilla.suse.com/979688 SUSE Bug 979688 https://www.suse.com/security/cve/CVE-2013-4566/ SUSE CVE CVE-2013-4566 page https://www.suse.com/security/cve/CVE-2014-3566/ SUSE CVE CVE-2014-3566 page https://www.suse.com/security/cve/CVE-2015-5244/ SUSE CVE CVE-2015-5244 page https://www.suse.com/security/cve/CVE-2016-3099/ SUSE CVE CVE-2016-3099 page SUSE Linux Enterprise Server 12-LTSS SUSE Linux Enterprise Server for SAP Applications 12 apache2-mod_nss-1.0.14-10.14.3 apache2-mod_nss-1.0.14-10.14.3 as a component of SUSE Linux Enterprise Server 12-LTSS apache2-mod_nss-1.0.14-10.14.3 as a component of SUSE Linux Enterprise Server for SAP Applications 12 mod_nss 1.0.8 and earlier, when NSSVerifyClient is set to none for the server/vhost context, does not enforce the NSSVerifyClient setting in the directory context, which allows remote attackers to bypass intended access restrictions. CVE-2013-4566 SUSE Linux Enterprise Server 12-LTSS:apache2-mod_nss-1.0.14-10.14.3 SUSE Linux Enterprise Server for SAP Applications 12:apache2-mod_nss-1.0.14-10.14.3 moderate 4 AV:N/AC:H/Au:N/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162396-1/ https://www.suse.com/security/cve/CVE-2013-4566.html CVE-2013-4566 https://bugzilla.suse.com/853039 SUSE Bug 853039 The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue. CVE-2014-3566 SUSE Linux Enterprise Server 12-LTSS:apache2-mod_nss-1.0.14-10.14.3 SUSE Linux Enterprise Server for SAP Applications 12:apache2-mod_nss-1.0.14-10.14.3 critical 5.8 AV:N/AC:M/Au:N/C:N/I:P/A:P 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162396-1/ https://www.suse.com/security/cve/CVE-2014-3566.html CVE-2014-3566 https://bugzilla.suse.com/1011293 SUSE Bug 1011293 https://bugzilla.suse.com/1031023 SUSE Bug 1031023 https://bugzilla.suse.com/901223 SUSE Bug 901223 https://bugzilla.suse.com/901254 SUSE Bug 901254 https://bugzilla.suse.com/901277 SUSE Bug 901277 https://bugzilla.suse.com/901748 SUSE Bug 901748 https://bugzilla.suse.com/901757 SUSE Bug 901757 https://bugzilla.suse.com/901759 SUSE Bug 901759 https://bugzilla.suse.com/901889 SUSE Bug 901889 https://bugzilla.suse.com/901968 SUSE Bug 901968 https://bugzilla.suse.com/902229 SUSE Bug 902229 https://bugzilla.suse.com/902233 SUSE Bug 902233 https://bugzilla.suse.com/902476 SUSE Bug 902476 https://bugzilla.suse.com/903405 SUSE Bug 903405 https://bugzilla.suse.com/903684 SUSE Bug 903684 https://bugzilla.suse.com/904889 SUSE Bug 904889 https://bugzilla.suse.com/905106 SUSE Bug 905106 https://bugzilla.suse.com/914041 SUSE Bug 914041 https://bugzilla.suse.com/994144 SUSE Bug 994144 The NSSCipherSuite option with ciphersuites enabled in mod_nss before 1.0.12 allows remote attackers to bypass application restrictions. CVE-2015-5244 SUSE Linux Enterprise Server 12-LTSS:apache2-mod_nss-1.0.14-10.14.3 SUSE Linux Enterprise Server for SAP Applications 12:apache2-mod_nss-1.0.14-10.14.3 critical 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162396-1/ https://www.suse.com/security/cve/CVE-2015-5244.html CVE-2015-5244 https://bugzilla.suse.com/945905 SUSE Bug 945905 mod_ns in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows remote attackers to force the use of ciphers that were not intended to be enabled. CVE-2016-3099 SUSE Linux Enterprise Server 12-LTSS:apache2-mod_nss-1.0.14-10.14.3 SUSE Linux Enterprise Server for SAP Applications 12:apache2-mod_nss-1.0.14-10.14.3 moderate 3.3 AV:L/AC:M/Au:N/C:P/I:P/A:N 5 AV:N/AC:L/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162396-1/ https://www.suse.com/security/cve/CVE-2016-3099.html CVE-2016-3099 https://bugzilla.suse.com/973996 SUSE Bug 973996