emerge apache without ssl heartbeat [solved]

Message

stmiller · Post by **stmiller** » Tue Apr 08, 2014 12:34 am

It light of this vuln, http://seclists.org/oss-sec/2014/q2/27 (CVE-2014-0160) I am curious if it is possible to emerge apache without the mod_ssl heartbeat feature.

Is that possible?

I can see that some TLS servers of various vendors have heartbeating disabled and I am curious if I can do the same with Gentoo. Ex:

Code: Select all

    
$ openssl s_client -connect www.qualys.com:443 -tlsextdebug

[skip] 

   PSK identity hint: None
    SRP username: None
    Start Time: 1396916504
    Timeout   : 300 (sec)
    Verify return code: 20 (unable to get local issuer certificate)
---
B
HEARTBEATING
140408723089064:error:1413B16D:SSL routines:SSL_F_TLS1_HEARTBEAT:peer does not accept heartbearts:t1_lib.c:2566:

stmiller · Post by **stmiller** » Tue Apr 08, 2014 1:18 am

Welp, answering my own question.

Emerging openssl with use flag of -tls-heartbeat does the trick. Thanks,

lagalopex · Post by **lagalopex** » Tue Apr 08, 2014 7:58 am

Alternative (and offtopic) to fix openssl but keep heartbeat enabled:
Update to dev-libs/openssl-1.0.1g (is already in portage)

SamuliSuominen · Post by **SamuliSuominen** » Tue Apr 08, 2014 8:15 am

1.0.1g is now stable on both, amd64 and x86, so time to `emerge --sync` and upgrade