You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by muthamilan Sargunaanandan <mu...@gmail.com> on 2014/09/12 23:53:58 UTC
[users@httpd]
Hello SMEs,
I'm having a Apache version httpd-2.2.22-win32-x86-openssl-0.9.8t.As
per Vulnerability report, Compression algorithms should be disabled.
Please help me , how to disable it.
Thanks in Advance
Regards
Muthu
AW: [users@httpd] Re: [wd-vc]
Posted by "Bremser, Kurt (AMOS Austria GmbH)" <Ku...@allianz.at>.
If you need to stay at 2.2, take the most recent version there. Otherwise migrate to the most recent version of 2.4. AFAIK, that means 2.2.27 or 2.4.10 at the moment.
Kurt Bremser
AMOS Austria
Newton was wrong. There is no gravity. The Earth sucks.
________________________________
Von: muthamilan Sargunaanandan [muthamilan@gmail.com]
Gesendet: Dienstag, 14. Oktober 2014 03:15
An: users@httpd.apache.org
Betreff: Re: [users@httpd] Re: [wd-vc]
Hello All,
Becuase of OpenSSL Multiple Remote SecurityVulnerabilities.,I'm planning to update my Apache from httpd-2.2.22-win32-x86-openssl-0.9.8t<http://httpd-2.2.22-win32-x86-openssl-0.9.8t.as/> . Please suggest me, which version will the best/stable version to update from 2.2.22.
Thanks in Advance.
Muthamilan
On Fri, Sep 19, 2014 at 11:44 PM, muthamilan Sargunaanandan <mu...@gmail.com>> wrote:
Hello SME,
My Production environment webserver Apache httpd-2.2.22-win32-x86-openssl-0.9.8t<http://httpd-2.2.22-win32-x86-openssl-0.9.8t.as/> having OpenSSL Multiple Remote Security Vulnerabilities.
As per the Vulnerability scan report , they suggested to upgrade the open ssl.
is it possible with out Apache upgrade, can I upgrade the open SSL verson? if yes, please let me know the procedure for the same.
Please guide me.
Thanks.
Muthamilan
On Fri, Sep 12, 2014 at 5:53 PM, muthamilan Sargunaanandan <mu...@gmail.com>> wrote:
Hello SMEs,
I'm having a Apache version httpd-2.2.22-win32-x86-openssl-0.9.8t.As<http://httpd-2.2.22-win32-x86-openssl-0.9.8t.As> per Vulnerability report, Compression algorithms should be disabled.
Please help me , how to disable it.
Thanks in Advance
Regards
Muthu
AMOS Austria GmbH
1130 Wien, Hietzinger Kai 101-105
FN 365014k, Handelsgericht Wien
UID: ATU 66614737
http://www.allianz.at
********************************************************
Dieses E-Mail und allfaellig daran angeschlossene Anhaenge
enthalten Informationen, die vertraulich und
ausschliesslich fuer den (die) bezeichneten Adressaten
bestimmt sind.
Wenn Sie nicht der genannte Adressat sind, darf dieses
E-Mail samt allfaelliger Anhaenge von Ihnen weder anderen
Personen zugaenglich gemacht noch in anderer Weise
verwertet werden.
Wenn Sie nicht der beabsichtigte Empfaenger sind, bitten
wir Sie, dieses E-Mail und saemtliche angeschlossene
Anhaenge zu loeschen.
Please note: This email and any files transmitted with it is
intended only for the named recipients and may contain
confidential and/or privileged information. If you are not the
intended recipient, please do not read, copy, use or disclose
the contents of this communication to others and notify the
sender immediately. Then please delete the email and any
copies of it. Thank you.
********************************************************
Re: [users@httpd] Re:
Posted by muthamilan Sargunaanandan <mu...@gmail.com>.
Hello All,
Becuase of OpenSSL Multiple Remote SecurityVulnerabilities.,I'm planning
to update my Apache from httpd-2.2.22-win32-x86-openssl-0.9.8t
<http://httpd-2.2.22-win32-x86-openssl-0.9.8t.as/> . Please suggest me,
which version will the best/stable version to update from 2.2.22.
Thanks in Advance.
Muthamilan
On Fri, Sep 19, 2014 at 11:44 PM, muthamilan Sargunaanandan <
muthamilan@gmail.com> wrote:
> Hello SME,
>
> My Production environment webserver Apache
> httpd-2.2.22-win32-x86-openssl-0.9.8t
> <http://httpd-2.2.22-win32-x86-openssl-0.9.8t.as/> having OpenSSL
> Multiple Remote Security Vulnerabilities.
>
> As per the Vulnerability scan report , they suggested to upgrade the open
> ssl.
>
> is it possible with out Apache upgrade, can I upgrade the open SSL verson?
> if yes, please let me know the procedure for the same.
>
> Please guide me.
>
>
> Thanks.
> Muthamilan
>
> On Fri, Sep 12, 2014 at 5:53 PM, muthamilan Sargunaanandan <
> muthamilan@gmail.com> wrote:
>
>> Hello SMEs,
>>
>> I'm having a Apache version httpd-2.2.22-win32-x86-openssl-0.9.8t.As
>> per Vulnerability report, Compression algorithms should be disabled.
>>
>> Please help me , how to disable it.
>>
>> Thanks in Advance
>>
>> Regards
>> Muthu
>>
>
>
[users@httpd] Re:
Posted by muthamilan Sargunaanandan <mu...@gmail.com>.
Hello SME,
My Production environment webserver Apache
httpd-2.2.22-win32-x86-openssl-0.9.8t
<http://httpd-2.2.22-win32-x86-openssl-0.9.8t.as/> having OpenSSL Multiple
Remote Security Vulnerabilities.
As per the Vulnerability scan report , they suggested to upgrade the open
ssl.
is it possible with out Apache upgrade, can I upgrade the open SSL verson?
if yes, please let me know the procedure for the same.
Please guide me.
Thanks.
Muthamilan
On Fri, Sep 12, 2014 at 5:53 PM, muthamilan Sargunaanandan <
muthamilan@gmail.com> wrote:
> Hello SMEs,
>
> I'm having a Apache version httpd-2.2.22-win32-x86-openssl-0.9.8t.As
> per Vulnerability report, Compression algorithms should be disabled.
>
> Please help me , how to disable it.
>
> Thanks in Advance
>
> Regards
> Muthu
>
Re: [users@httpd]
Posted by muthamilan Sargunaanandan <mu...@gmail.com>.
Hello Jeff,
Thanks for your support.
Regards
Muthamilan
On Sat, Sep 13, 2014 at 10:05 AM, Jeff Trawick <tr...@gmail.com> wrote:
> On Fri, Sep 12, 2014 at 6:03 PM, muthamilan Sargunaanandan <
> muthamilan@gmail.com> wrote:
>
>> + I'm using windows2008R2 64bit OS
>>
>> On Fri, Sep 12, 2014 at 5:53 PM, muthamilan Sargunaanandan <
>> muthamilan@gmail.com> wrote:
>>
>>> Hello SMEs,
>>>
>>> I'm having a Apache version httpd-2.2.22-win32-x86-openssl-0.9.8t.As
>>> per Vulnerability report, Compression algorithms should be disabled.
>>>
>>> Please help me , how to disable it.
>>>
>>> Thanks in Advance
>>>
>>> Regards
>>> Muthu
>>>
>>
>>
> Recommendation: Upgrade to the latest httpd 2.2.X version and use the
> directive "SSLCompression off" (which is the default in the latest version
> anyway).
>
> Alternative, using your level of httpd and OpenSSL: It MAY be possible to
> disable compression with the the environment variable setting
> OPENSSL_NO_DEFAULT_ZLIB=yes, but I'm not 100% sure that OpenSSL 0.9.8t
> supports that (check the source or change log???), and Windows environment
> variable configuration is perhaps error prone depending on how you run
> httpd. If you try this, figure out how to use openssl s_client to check
> for server compression support with/without the environment variable
> setting.
>
>
> --
> Born in Roswell... married an alien...
> http://emptyhammock.com/
>
>
Re: [users@httpd]
Posted by Jeff Trawick <tr...@gmail.com>.
On Fri, Sep 12, 2014 at 6:03 PM, muthamilan Sargunaanandan <
muthamilan@gmail.com> wrote:
> + I'm using windows2008R2 64bit OS
>
> On Fri, Sep 12, 2014 at 5:53 PM, muthamilan Sargunaanandan <
> muthamilan@gmail.com> wrote:
>
>> Hello SMEs,
>>
>> I'm having a Apache version httpd-2.2.22-win32-x86-openssl-0.9.8t.As
>> per Vulnerability report, Compression algorithms should be disabled.
>>
>> Please help me , how to disable it.
>>
>> Thanks in Advance
>>
>> Regards
>> Muthu
>>
>
>
Recommendation: Upgrade to the latest httpd 2.2.X version and use the
directive "SSLCompression off" (which is the default in the latest version
anyway).
Alternative, using your level of httpd and OpenSSL: It MAY be possible to
disable compression with the the environment variable setting
OPENSSL_NO_DEFAULT_ZLIB=yes, but I'm not 100% sure that OpenSSL 0.9.8t
supports that (check the source or change log???), and Windows environment
variable configuration is perhaps error prone depending on how you run
httpd. If you try this, figure out how to use openssl s_client to check
for server compression support with/without the environment variable
setting.
--
Born in Roswell... married an alien...
http://emptyhammock.com/
Re: [users@httpd]
Posted by muthamilan Sargunaanandan <mu...@gmail.com>.
+ I'm using windows2008R2 64bit OS
On Fri, Sep 12, 2014 at 5:53 PM, muthamilan Sargunaanandan <
muthamilan@gmail.com> wrote:
> Hello SMEs,
>
> I'm having a Apache version httpd-2.2.22-win32-x86-openssl-0.9.8t.As
> per Vulnerability report, Compression algorithms should be disabled.
>
> Please help me , how to disable it.
>
> Thanks in Advance
>
> Regards
> Muthu
>