CVE-2009-3555 tracking bug

[Marc Deslauriers]

Binary package hint: openssl

This is the main bug that will track CVE-2009-3555 updates. Please report any regression in this bug.

[Kees Cook (kees)]

I can confirm that the firefox CVE-2009-3555 warnings go away once these packages are installed on Lucid. Additionally, I tested that sasl and dovecot still work as expected. Awesome. :)

[Launchpad Janitor (janitor)]

This bug was fixed in the package apache2 - 2.2.8-1ubuntu0.18

---------------
apache2 (2.2.8-1ubuntu0.18) hardy-security; urgency=low

  * debian/patches/212_sslinsecurerenegotiation-directive.dpatch: once
    openssl gets updated to fix CVE-2009-3555, server renegotiations with
    unpatched clients will fail. This patch adds the ability to revert to
    the previous unsafe behaviour with a new SSLInsecureRenegotiation
    directive. (LP: #616759)
  * debian/control: add specific dependency on first openssl version to get
    CVE-2009-3555 fix.
 -- Marc Deslauriers <email address hidden> Mon, 16 Aug 2010 13:39:40 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package openssl - 0.9.8g-4ubuntu3.10

---------------
openssl (0.9.8g-4ubuntu3.10) hardy-security; urgency=low

  * SECURITY UPDATE: TLS renegotiation flaw (LP: #616759)
    - apps/{s_cb,s_client,s_server}.c, doc/ssl/SSL_CTX_set_options.pod,
      ssl/{d1_both,d1_clnt,d1_srvr,s3_both,s3_clnt,s3_pkt,s3_srvr,ssl_err,
      ssl_lib,t1_lib,t1_reneg}.c, ssl/Makefile, ssl/{ssl3,ssl,ssl_locl,
      tls1}.h: backport rfc5746 support from openssl 0.9.8m.
    - CVE-2009-3555
  * Enable tlsext, and backport some patches from jaunty now that tlsext is
    enabled.
    - Fix a problem with tlsext preventing firefox 3 from connection.
    - Don't add extentions to ssl v3 connections. It breaks with some
      other software.
 -- Marc Deslauriers <email address hidden> Thu, 12 Aug 2010 08:35:55 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package apache2 - 2.2.11-2ubuntu2.7

---------------
apache2 (2.2.11-2ubuntu2.7) jaunty-security; urgency=low

  * debian/patches/909_sslinsecurerenegotiation-directive.dpatch: once
    openssl gets updated to fix CVE-2009-3555, server renegotiations with
    unpatched clients will fail. This patch adds the ability to revert to
    the previous unsafe behaviour with a new SSLInsecureRenegotiation
    directive. (LP: #616759)
  * debian/control: add specific dependency on first openssl version to get
    CVE-2009-3555 fix.
 -- Marc Deslauriers <email address hidden> Mon, 16 Aug 2010 13:34:47 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package openssl - 0.9.8g-15ubuntu3.5

---------------
openssl (0.9.8g-15ubuntu3.5) jaunty-security; urgency=low

  * SECURITY UPDATE: TLS renegotiation flaw (LP: #616759)
    - apps/{s_cb,s_client,s_server}.c, doc/ssl/SSL_CTX_set_options.pod,
      ssl/{d1_both,d1_clnt,d1_srvr,s3_both,s3_clnt,s3_pkt,s3_srvr,ssl_err,
      ssl_lib,t1_lib,t1_reneg}.c, ssl/Makefile, ssl/{ssl3,ssl,ssl_locl,
      tls1}.h: backport rfc5746 support from openssl 0.9.8m.
    - CVE-2009-3555
 -- Marc Deslauriers <email address hidden> Thu, 12 Aug 2010 08:34:41 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package apache2 - 2.2.12-1ubuntu2.3

---------------
apache2 (2.2.12-1ubuntu2.3) karmic-security; urgency=low

  * debian/patches/905_sslinsecurerenegotiation-directive.dpatch: once
    openssl gets updated to fix CVE-2009-3555, server renegotiations with
    unpatched clients will fail. This patch adds the ability to revert to
    the previous unsafe behaviour with a new SSLInsecureRenegotiation
    directive. (LP: #616759)
  * debian/control: add specific dependency on first openssl version to get
    CVE-2009-3555 fix.
 -- Marc Deslauriers <email address hidden> Mon, 16 Aug 2010 13:26:28 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package openssl - 0.9.8g-16ubuntu3.2

---------------
openssl (0.9.8g-16ubuntu3.2) karmic-security; urgency=low

  * SECURITY UPDATE: TLS renegotiation flaw (LP: #616759)
    - apps/{s_cb,s_client,s_server}.c, doc/ssl/SSL_CTX_set_options.pod,
      ssl/{d1_both,d1_clnt,d1_srvr,s3_both,s3_clnt,s3_pkt,s3_srvr,ssl_err,
      ssl_lib,t1_lib,t1_reneg}.c, ssl/Makefile, ssl/{ssl3,ssl,ssl_locl,
      tls1}.h: backport rfc5746 support from openssl 0.9.8m.
    - CVE-2009-3555
 -- Marc Deslauriers <email address hidden> Thu, 12 Aug 2010 08:32:19 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package apache2 - 2.2.14-5ubuntu8.2

---------------
apache2 (2.2.14-5ubuntu8.2) lucid-security; urgency=low

  * debian/patches/211-sslinsecurerenegotiation-directive.dpatch: once
    openssl gets updated to fix CVE-2009-3555, server renegotiations with
    unpatched clients will fail. This patch adds the ability to revert to
    the previous unsafe behaviour with a new SSLInsecureRenegotiation
    directive. (LP: #616759)
  * debian/control: add specific dependency on first openssl version to get
    CVE-2009-3555 fix.
 -- Marc Deslauriers <email address hidden> Wed, 18 Aug 2010 16:37:47 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package openssl - 0.9.8k-7ubuntu8.1

---------------
openssl (0.9.8k-7ubuntu8.1) lucid-security; urgency=low

  * SECURITY UPDATE: TLS renegotiation flaw (LP: #616759)
    - debian/patches/CVE-2009-3555-RFC5746.patch: backport rfc5746 support
      from openssl 0.9.8m.
    - CVE-2009-3555
 -- Marc Deslauriers <email address hidden> Thu, 12 Aug 2010 08:30:03 -0400