Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 537012 - bugs.gentoo.org enables bad (anon) TLS/HTTPS ciphers
Summary: bugs.gentoo.org enables bad (anon) TLS/HTTPS ciphers
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Infrastructure
Classification: Unclassified
Component: Other web server issues (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Infrastructure
URL: https://www.ssllabs.com/ssltest/analy...
Whiteboard:
Keywords:
: 538122 (view as bug list)
Depends on:
Blocks:
 
Reported: 2015-01-19 00:14 UTC by Hanno Böck
Modified: 2015-01-29 10:10 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Hanno Böck gentoo-dev 2015-01-19 00:14:34 UTC 
The TLS/HTTPS server configuration of bugs.gentoo.org enables anonymous cipher suites:
https://www.ssllabs.com/ssltest/analyze.html?d=bugs.gentoo.org

This is bad. Anon ciphers are not really suited for web use (and likely they'll be removed in the upcoming TLS 1.3), because they provide no authentication. They should be disabled.

(There are a couple of other things in the TLS config that could be improved, e.g. enabling HSTS, OCSP stapling, disabling RC4, but I think the cipher suite issue is the most severe one)
Comment 1 Karol Herbst 2015-01-28 21:08:51 UTC 
whats the status here? I noticed the same thing and am kind of interested, that this gets resolved, too.
Comment 2 Alex Legler (RETIRED) archtester gentoo-dev Security 2015-01-28 21:14:45 UTC 
Status:	RESOLVED FIXED

as per the bug metadata
Comment 3 Karol Herbst 2015-01-29 02:32:20 UTC 
Oh I missed the bugs.* part. I was checking the root domain today: gentoo.org and there are the same security concerns described for bugs.gentoo.org. But I guess this should be another bug :/ sorry for that.
Comment 4 Alex Legler (RETIRED) archtester gentoo-dev Security 2015-01-29 10:10:09 UTC 
*** Bug 538122 has been marked as a duplicate of this bug. ***