You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2010/01/29 06:25:19 UTC

DO NOT REPLY [Bug 48638] New: DTLS in Apache Server 2.2.6

https://issues.apache.org/bugzilla/show_bug.cgi?id=48638

           Summary: DTLS in Apache Server 2.2.6
           Product: Apache httpd-2
           Version: 2.2.6
          Platform: PC
        OS/Version: Windows Server 2003
            Status: NEW
          Severity: major
          Priority: P2
         Component: All
        AssignedTo: bugs@httpd.apache.org
        ReportedBy: sasha.matison@ca.com


Hello,

According to the following security advisory
http://www.openssl.org/news/secadv_20071012.txt a flaw has been discovered in
OpenSSL's DTLS implementation. How does this advisory apply to Apache Server
2.2.6?

More specifically:

- Can DTLS be used in the context of Apache Server? If yes - what needs to be
done to enable it?
- Is SSL_get_shared_ciphers() method being used directly/indirectly by the
Apache Server code?

Thank you,
Sasha.

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

DO NOT REPLY [Bug 48638] DTLS in Apache Server 2.2.6

Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=48638

Ruediger Pluem <rp...@apache.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |INVALID

--- Comment #1 from Ruediger Pluem <rp...@apache.org> 2010-01-29 00:12:34 CET ---
First of all bugzilla is no user support forum but for reporting bugs. So
please post your question on the users / dev list.
Regarding the security issue: Upgrade your openssl to an unaffected version and
you are safe.

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org