)]}'
{"security-notes/OSSN-0039":[{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"e0ddb35b0b4bc640dc16e317d5c024cc6dc0c315","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Configuring your OpenStack deployment to prevent POODLE attacks"},{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9aa7fdbe_f66ec495","line":1,"updated":"2014-10-20 16:49:56.000000000","message":"I don\u0027t think notes normally address an individual directly.\n\nPerhaps:\nConfiguring OpenStack deployments to prevent POODLE attacks ?","commit_id":"a9fa10723d96de1f107eb06f1ffe9b2247a8232a"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"bfabdc8c923bf4063731d1089090052df1a9c859","unresolved":false,"context_lines":[{"line_number":17,"context_line":"- Web servers (Apache, Nginx, etc)"},{"line_number":18,"context_line":"- SSL/TLS terminators (Stud, Pound, etc)"},{"line_number":19,"context_line":"- Proxy services (HAProxy, etc)"},{"line_number":20,"context_line":"- Miscelanious services (eventlet, syslog, ldap, smtp, etc)"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"### Discussion ###"},{"line_number":23,"context_line":"The POODLE attack was first announced on 14 Oct 2014 [1]. For a deeper"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9aa7fdbe_ee8fda73","line":20,"updated":"2014-10-19 13:56:28.000000000","message":"change \"Miscelanious\" to \"Miscellaneous\"","commit_id":"a9fa10723d96de1f107eb06f1ffe9b2247a8232a"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"33d617bd5810457394ddb06120117f7b3ccbdf97","unresolved":false,"context_lines":[{"line_number":43,"context_line":"    openssl s_client -connect \u003cdomain name\u003e:\u003cport\u003e -ssl3"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"If the server does not support SSLv3, you will see a handshake failure"},{"line_number":46,"context_line":"message. This indicates that the server requires an updated"},{"line_number":47,"context_line":"configuration. Note that you can perform this step for any service"},{"line_number":48,"context_line":"that has SSL/TLS enabled including OpenStack API endpoints."},{"line_number":49,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9aa7fdbe_e3f8c3e7","line":46,"updated":"2014-10-20 13:52:31.000000000","message":"I read \u0027this indicates that the server requires an updated configuration\u0027 to mean that I now need to go and update the configuration on the server. I would reword this to say something like:\n\n\u0027This indicates that the server does not allow SSLv3 connections and requires clients connect using TLSv1.0 or better\u0027.  \n\nAlthough arguably this statement is wrong, because we have not told them to disable SSLv2 as well...","commit_id":"a9fa10723d96de1f107eb06f1ffe9b2247a8232a"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"bfabdc8c923bf4063731d1089090052df1a9c859","unresolved":false,"context_lines":[{"line_number":49,"context_line":""},{"line_number":50,"context_line":"Testing clients is more cumbersome. One option is to setup a web server"},{"line_number":51,"context_line":"that only supports SSLv3, and try connecting your client to this"},{"line_number":52,"context_line":"server. A successful connection indicats that the client requires an"},{"line_number":53,"context_line":"updated configuration."},{"line_number":54,"context_line":""},{"line_number":55,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9aa7fdbe_2ee9e21a","line":52,"updated":"2014-10-19 13:56:28.000000000","message":"change \"indicats\" to \"indicates\"\n\nAlso, you don\u0027t need a web server for this. openssl s_server can be used. The command looks like this:\n\n openssl s_server \\\n -cert \u003cfilename\u003e \\ # defaults to server.pem\n -key \u003cfilename\u003e \\ # defaults to server.pem\n -state \\\n -cipher \u003carg\u003e \\\n -ssl2 -ssl3 -tls1_2 -tls1_1 -tls1 -dtls1 \\\n -no_ssl2 -no_ssl3 -no_tls1 -no_tls1_1 -no_tls1_2 \\\n -tlsextdebug","commit_id":"a9fa10723d96de1f107eb06f1ffe9b2247a8232a"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"e0ddb35b0b4bc640dc16e317d5c024cc6dc0c315","unresolved":false,"context_lines":[{"line_number":49,"context_line":""},{"line_number":50,"context_line":"Testing clients is more cumbersome. One option is to setup a web server"},{"line_number":51,"context_line":"that only supports SSLv3, and try connecting your client to this"},{"line_number":52,"context_line":"server. A successful connection indicats that the client requires an"},{"line_number":53,"context_line":"updated configuration."},{"line_number":54,"context_line":""},{"line_number":55,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9aa7fdbe_6aef48b1","line":52,"in_reply_to":"9aa7fdbe_2ee9e21a","updated":"2014-10-20 16:49:56.000000000","message":"+1 for continuing to use openssl s_client and s_server to test.","commit_id":"a9fa10723d96de1f107eb06f1ffe9b2247a8232a"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"bfabdc8c923bf4063731d1089090052df1a9c859","unresolved":false,"context_lines":[{"line_number":70,"context_line":"Review the output and ensure that it is linked to the new version of"},{"line_number":71,"context_line":"OpenSSL that includes TLS_FALLBACK_SCSV support."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"Disabling SSLv3 can be done at either the application level, or the"},{"line_number":74,"context_line":"library level. Doing it at the library level ensures consistency"},{"line_number":75,"context_line":"throughout the cloud. However, if you are not already compiling"},{"line_number":76,"context_line":"OpenSSL then this may not fit into your deployment workflow. In this"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9aa7fdbe_ced93685","line":73,"updated":"2014-10-19 13:56:28.000000000","message":"remove , after level","commit_id":"a9fa10723d96de1f107eb06f1ffe9b2247a8232a"},{"author":{"_account_id":964,"name":"Anne Gentle","email":"annegentle@justwriteclick.com","username":"annegentle"},"change_message_id":"4d5ed7e5d2217ce3ed2b394fbb9d5079d604d142","unresolved":false,"context_lines":[{"line_number":62,"context_line":"                     -tlsextdebug"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"Next, connect each client to this endpoint. A successful connection"},{"line_number":65,"context_line":"indicates that the client requires an updated configuration."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"### Recommended Actions ###"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"9aa7fdbe_80fc4040","line":65,"updated":"2014-10-20 19:33:33.000000000","message":"If the client can connect to this endpoint, the client needs to update their configuration. See below discussion on TLS_FALLBACK_SCSV under Recommended Actions.","commit_id":"336cef506c53451e9e8198aa8fea26a8aa9eb411"},{"author":{"_account_id":964,"name":"Anne Gentle","email":"annegentle@justwriteclick.com","username":"annegentle"},"change_message_id":"4d5ed7e5d2217ce3ed2b394fbb9d5079d604d142","unresolved":false,"context_lines":[{"line_number":133,"context_line":""},{"line_number":134,"context_line":"### Contacts / References ###"},{"line_number":135,"context_line":"This OSSN: https://wiki.openstack.org/wiki/OSSN/OSSN-0039"},{"line_number":136,"context_line":"Original LaunchPad Bug: https://bugs.launchpad.net/ossn/+bug/1382270"},{"line_number":137,"context_line":"OpenStack Security ML: openstack-security@lists.openstack.org"},{"line_number":138,"context_line":"OpenStack Security Group: https://launchpad.net/~openstack-ossg"},{"line_number":139,"context_line":"CVE: CVE-2014-3566"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"9aa7fdbe_207394ea","line":136,"updated":"2014-10-20 19:33:33.000000000","message":"Launchpad (no need for CamelCase).","commit_id":"336cef506c53451e9e8198aa8fea26a8aa9eb411"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"9d5ae2bf147306ae1b97ee394e19b9327011f0a2","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Affected Services / Software ###"},{"line_number":14,"context_line":"Any service using SSLv3. Depending on the backend SSL library, this"},{"line_number":15,"context_line":"can include many components of an OpenStack cloud:"},{"line_number":16,"context_line":"- OpenStack services"},{"line_number":17,"context_line":"- OpenStack clients"},{"line_number":18,"context_line":"- Web servers (Apache, Nginx, etc)"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"9aa7fdbe_86519710","line":15,"updated":"2014-10-21 18:51:32.000000000","message":"(nit) We should probably add a blank line before this list.","commit_id":"06cf3e54e076191c7327b2b39bfd332c52162639"}]}