Re: [bitfolk] SSL POODLE (CVE-2014-3566) vulnerabilities amo…

Top Page
Author: Andy Smith
Date:  
To: users
Subject: Re: [bitfolk] SSL POODLE (CVE-2014-3566) vulnerabilities amongst the customer base

Reply to this message
gpg: Signature made Thu Oct 16 12:02:31 2014 UTC
gpg: using DSA key 2099B64CBF15490B
gpg: Good signature from "Andy Smith <andy@strugglers.net>" [unknown]
gpg: aka "Andrew James Smith <andy@strugglers.net>" [unknown]
gpg: aka "Andy Smith (UKUUG) <andy.smith@ukuug.org>" [unknown]
gpg: aka "Andy Smith (BitFolk Ltd.) <andy@bitfolk.com>" [unknown]
gpg: aka "Andy Smith (Linux User Groups UK) <andy@lug.org.uk>" [unknown]
gpg: aka "Andy Smith (Cernio Technology Cooperative) <andy.smith@cernio.com>" [unknown]
Hello,

On Thu, Oct 16, 2014 at 12:41:33PM +0100, Mike Zanker wrote:
> On 16/10/2014 12:34, Andy Smith wrote:
>
> >On Apache 2.2 or older:
> >
> >     You'll need to use "SSLProtocol TLSv1"

>
> The 2.2 that comes with RHEL/CentOS 5.x supports "-SSLv3" (but they
> do backport things from newer versions sometimes).


It's possible I should have said "older than 2.2". Or it might be
some other version cut-off, not sure! If one doesn't work the other
should, anyway. :)

Cheers,
Andy

--
http://bitfolk.com/ -- No-nonsense VPS hosting