After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 310272 - SSLv2 must be deactivated by default
SSLv2 must be deactivated by default
Status: RESOLVED NOTABUG
Product: epiphany
Classification: Core
Component: General
unspecified
Other Linux
: Normal major
: ---
Assigned To: Epiphany Maintainers
Marco Pesenti Gritti
Depends on:
Blocks:
 
 
Reported: 2005-07-13 21:09 UTC by Loïc Minier
Modified: 2005-08-21 17:39 UTC
See Also:
GNOME target: ---
GNOME version: 2.9/2.10


Description Loïc Minier 2005-07-13 21:09:51 UTC 
Hi,

SSLv2 has major security flaws, please disable it by default.

This can be done by adding the following text to default-prefs.js:

// disable SSLv2, it has security issues
pref("security.enable_ssl2", false);

See this thread for details:
http://lists.alioth.debian.org/pipermail/pkg-mozilla-maintainers/2005-April/thread.html#22

Bye,
Comment 1 Christian Persch 2005-07-13 22:28:19 UTC 
This is for the NSS guys to decide,
https://bugzilla.mozilla.org/show_bug.cgi?id=247830 . I tried this once, but go
a complaint (that site has since been fixed, but there still are others that are
ssl2 only).
Comment 2 Loïc Minier 2005-07-14 18:50:11 UTC 
Hmmm, maybe you skipped that in the thread but:
- Firefox, and Galeon already do this,
- it's *very* insecure.

If you got complaints on that support, you can tell them about user.js, or
about:config, or even add an /etc override file, this would be more elegant a
solution to the problem.  (Firefox has UI in the prefs for that, but I know how
painful that can be to add.)

Bye,
Comment 3 Christian Persch 2005-07-14 19:47:40 UTC 
Firefox does not disable SSL v2:
http://lxr.mozilla.org/seamonkey/source/netwerk/base/public/security-prefs.js#3
Comment 4 Loïc Minier 2005-07-15 20:48:15 UTC 
Oh sorry, it's disabled in the Debian package.
Comment 5 Christian Persch 2005-08-21 17:39:40 UTC 
We'll use the upstream SSL prefs.