Home page logo

fulldisclosure logo Full Disclosure mailing list archives

[SECURITY] [DSA-2141-1] New apache2 packages add backward compatibility option
From: Stefan Fritsch <sf () debian org>
Date: Wed, 05 Jan 2011 23:21:00 +0000

Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-2141-3                  security () debian org
http://www.debian.org/security/                           Stefan Fritsch
January 06, 2011                      http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package        : apache2
Vulnerability  : backward compatibility option for SSL/TLS insecure
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2009-3555
Debian Bug     : 587037

DSA-2141-1 changed the behaviour of the openssl libraries in a server
environment to only allow SSL/TLS renegotiation for clients that
support the RFC5746 renegotiation extension. This update to apache2
adds the new SSLInsecureRenegotiation configuration option that allows
to restore support for insecure clients. More information can be found
in the file /usr/share/doc/apache2.2-common/NEWS.Debian.gz .

For the stable distribution (lenny), the compatibility option has been
included in version 2.2.9-10+lenny9.

In addition, apache2-mpm-itk has been rebuilt to work with the updated
apache2 packages. The new version number is 2.2.6-02-1+lenny4.

For the unstable distribution (sid), and the testing distribution
(squeeze), the compatibility option has been included since version

We recommend that you upgrade your apache2 and apache2-mpm-itk

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: debian-security-announce () lists debian org
Version: GnuPG v1.4.10 (GNU/Linux)


Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
  • [SECURITY] [DSA-2141-1] New apache2 packages add backward compatibility option Stefan Fritsch (Jan 06)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]