Upstream disabled SSLv3 in v0.10.33. I've been putting off dealing with it because I've been very busy, but I already got a request to do the same in EPEL [1].
I was leaning toward not disabling it in <F20 and EPEL, since we typically don't do that sort of thing in stable releases. But it could get very confusing if upstream has disabled SSLv3 and we're shipping versions that claim to have it disabled. So I guess stable releases will be stuck at 0.10.32 + backports from future stable releases forever. Unless I'm being too pedantic and should just push the new upstream release unmodified?
However, I think it's still early enough to do this for F21 at least so that's not stuck with the same issue forever. So unless anyone objects, I'm going to push an update in the next couple days and get it submitted before Final Freeze.
Thanks! -T.C.
On Nov 10, 2014, at 11:19 PM, T.C. Hollingsworth tchollingsworth@gmail.com wrote:
Upstream disabled SSLv3 in v0.10.33. I've been putting off dealing with it because I've been very busy, but I already got a request to do the same in EPEL [1].
I was leaning toward not disabling it in <F20 and EPEL, since we typically don't do that sort of thing in stable releases. But it could get very confusing if upstream has disabled SSLv3 and we're shipping versions that claim to have it disabled. So I guess stable releases will be stuck at 0.10.32 + backports from future stable releases forever. Unless I'm being too pedantic and should just push the new upstream release unmodified?
However, I think it's still early enough to do this for F21 at least so that's not stuck with the same issue forever. So unless anyone objects, I'm going to push an update in the next couple days and get it submitted before Final Freeze.
I'd say that this *specific* change is acceptable for backport to the stable branches because of the POODLE vulnerability. Plenty of other packages are making this change.
Is it possible to carry a patch that allows our users to re-enable it at runtime if they absolutely must? If so, that's probably the optimum solution.
Thanks! -T.C.
[1] https://bugzilla.redhat.com/show_bug.cgi?id=1161900 _______________________________________________ nodejs mailing list nodejs@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/nodejs
On Nov 11, 2014 12:44 AM, "Stephen Gallagher" sgallagh@redhat.com wrote:
On Nov 10, 2014, at 11:19 PM, T.C. Hollingsworth <
tchollingsworth@gmail.com> wrote:
Upstream disabled SSLv3 in v0.10.33. I've been putting off dealing with it because I've been very busy, but I already got a request to do the same in EPEL [1].
I was leaning toward not disabling it in <F20 and EPEL, since we typically don't do that sort of thing in stable releases. But it could get very confusing if upstream has disabled SSLv3 and we're shipping versions that claim to have it disabled. So I guess stable releases will be stuck at 0.10.32 + backports from future stable releases forever. Unless I'm being too pedantic and should just push the new upstream release unmodified?
However, I think it's still early enough to do this for F21 at least so that's not stuck with the same issue forever. So unless a
I'd say that this *specific* change is acceptable for backport to the
stable branches because of the POODLE vulnerability. Plenty of other packages are making this change.
After confirming the answer to your next question I don't have any problem with this. And nobody else commented, so unless someone objects I'll send 0.10.33 to testing as soon as I can use something better than a phone. :-)
I'll announce here and on epel-announce after they are pushed.
Is it possible to carry a patch that allows our users to re-enable it at
runtime if they absolutely must? If so, that's probably the optimum solution.
The upstream fix adds an `--enable-ssl3` argument to the `node` executable to re-enable SSLv3 fallback. Also, any code that explicitly requests 'SSLv3_method' while opening the connection will continue to use only SSLv3 regardless of whether the flag is set.
This is described in detail here: https://nodejs.org/api/tls.html#tls_protocol_support
I'll make sure to include this information in the aforementioned announcement.
Thanks, -T.C.
P.S. I haven't forgotten that e-mail regarding npm/rpm integration, but I've been way too busy to do much justice to a reply. Sorry. :-( I figure you are too getting F21 out the door. (Lots of awesome stuff in Server BTW, thanks!) Hopefully we can get back to it after the holidays?
nodejs@lists.fedoraproject.org
-
Stephen Gallagher -
T.C. Hollingsworth