[apache2] 01/01: Disable SSL 3.0 in default config

[Stefan Fritsch]

This is an automated email from the git hooks/post-receive script.

sf pushed a commit to branch master
in repository apache2.

commit 7b0dfed0df60be1c3ba185ab78964314455d4972
Author: Stefan Fritsch <sf at sfritsch.de>
Date:   Tue Oct 14 22:24:30 2014 +0200

    Disable SSL 3.0 in default config
---
 debian/changelog                          | 6 ++++++
 debian/config-dir/mods-available/ssl.conf | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/debian/changelog b/debian/changelog
index e9bee04..213e9be 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+apache2 (2.4.10-6) UNRELEASED; urgency=medium
+
+  * Disable SSL 3.0 in default config. Closes: #765347
+
+ -- Stefan Fritsch <sf at debian.org>  Tue, 14 Oct 2014 22:23:40 +0200
+
 apache2 (2.4.10-5) unstable; urgency=medium
 
   * Remove one forgotten instance of ident.load in the preinst.
diff --git a/debian/config-dir/mods-available/ssl.conf b/debian/config-dir/mods-available/ssl.conf
index a0d7adc..8be989f 100644
--- a/debian/config-dir/mods-available/ssl.conf
+++ b/debian/config-dir/mods-available/ssl.conf
@@ -70,7 +70,7 @@
 	#   The protocols to enable.
 	#   Available values: all, SSLv3, TLSv1, TLSv1.1, TLSv1.2
 	#   SSL v2  is no longer supported
-	SSLProtocol all
+	SSLProtocol all -SSLv3
 
 	#   Allow insecure renegotiation with clients which do not yet support the
 	#   secure renegotiation protocol. Default: Off

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-apache/apache2.git