# HG changeset patch
# User Pascal Bellard <pascal.bellard@slitaz.org>
# Date 1413634293 -7200
# Node ID f2bdc266fba2770b3b6c32984695be2f51b7858a
# Parent  cfd1497385a0671c28738eec03479c662296004e
postfix, apache lighttpd-ssl, nginx: CVE-2014-3566

diff -r cfd1497385a0 -r f2bdc266fba2 apache/receipt
--- a/apache/receipt	Sat Oct 18 13:24:48 2014 +0200
+++ b/apache/receipt	Sat Oct 18 14:11:33 2014 +0200
@@ -59,6 +59,11 @@
 		-e 's|#LoadModule ssl_module|LoadModule ssl_module|' \
 		$fs/etc/apache/httpd.conf $fs/etc/apache/extra/httpd-ssl.conf
 	echo "Include /etc/apache/conf.d" >> $fs/etc/apache/httpd.conf
+	cat >> $fs/etc/apache/extra/httpd-ssl.conf <<EOT
+
+# Unsafe, see CVE-2014-3566 POODLE
+SSLProtocol All -SSLv2 -SSLv3
+EOT
 }
 
 # Pre and post install commands for Tazpkg.
diff -r cfd1497385a0 -r f2bdc266fba2 lighttpd-ssl/receipt
--- a/lighttpd-ssl/receipt	Sat Oct 18 13:24:48 2014 +0200
+++ b/lighttpd-ssl/receipt	Sat Oct 18 14:11:33 2014 +0200
@@ -76,6 +76,9 @@
 \$SERVER["socket"] == ":443" {
   protocol = "https://"
   ssl.engine    = "enable"
+  # Unsafe, see CVE-2014-3566 POODLE
+  ssl.use-sslv2 = "disable"
+  ssl.use-sslv3 = "disable"
   ssl.pemfile   = "/etc/ssl/lighttpd/lighttpd.pem"
 }
 EOT
diff -r cfd1497385a0 -r f2bdc266fba2 nginx/receipt
--- a/nginx/receipt	Sat Oct 18 13:24:48 2014 +0200
+++ b/nginx/receipt	Sat Oct 18 14:11:33 2014 +0200
@@ -63,6 +63,8 @@
         rm -rf $fs/usr/html
         cp -a stuff/* $fs
         sed -i 's/#user  nobody;/user  www;/' $fs/etc/nginx/nginx.conf
+	# SSLv3 is unsafe, see CVE-2014-3566 POODLE
+        sed -i 's/ssl_protocols.* /ssl_protocols TLSv1 TLSv1.1 TLSv1.2;/' $fs/etc/nginx/nginx.conf
 }
 
 # Pre and post install commands for Tazpkg.
diff -r cfd1497385a0 -r f2bdc266fba2 postfix/receipt
--- a/postfix/receipt	Sat Oct 18 13:24:48 2014 +0200
+++ b/postfix/receipt	Sat Oct 18 14:11:33 2014 +0200
@@ -60,6 +60,11 @@
 mynetworks = 127.0.0.0/8
 alias_maps = hash:/etc/postfix/aliases
 EOF
+	cat >> $fs/etc/postfix/main.cf <<EOT
+
+# Unsafe, see CVE-2014-3566 POODLE
+smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
+EOF
 	cp -a $stuff/etc $fs
 	cp -a $install/var $fs
 	mv $fs/etc/postfix/TLS_LICENSE $fs/usr/share/licenses/POSTFIX_TLS_LICENSE