This update for cyrus-imapd fixes the following issues: - Previous versions of cyrus-imapd would not allow its users to disable old SSL variants that are vulnerable to attacks like BEAST and POODLE. This patch adds the configuration option 'tls_versions' to remedy that issue. Note that users who upgrade an existing installation will *not* have their imapd.conf file overwritten, i.e. their IMAP server will continue to support SSLv2 and SSLv3 like before. To disable support for those protocols, edit imapd.conf manually to include "tls_versions: tls1_0 tls1_1 tls1_2". New installations, however, will have an imapd.conf file that contains these settings already, i.e. newly installed IMAP servers do *not* support unsafe versions of SSL unless that support is explicitly enabled by the user. (bsc#901748)
#860611 #901748 #954200 #954201 #981670
Cross- CVE-2014-3566 CVE-2015-8076 CVE-2015-8077
CVE-2015-8078
Affected Products:
SUSE Linux Enterprise Software Development Kit 11-SP4
SUSE Linux Enterprise Server 11-SP4
SUSE Linux Enterprise Debuginfo 11-SP4
https://www.suse.com/security/cve/CVE-2014-3566.html
https://www.suse.com/security/cve/CVE-2015-8076.html
https://www.suse.com/security/cve/CVE-2015-8077.html
https://www.suse.com/security/cve/CVE-2015-8078.html
https://bugzilla.suse.com/860611
https://bugzilla.suse.com/901748
https://bugzilla.suse.com/954200
https://bugzilla.suse.com/954201
https://bugzilla.suse.com/981670
Get the latest Linux and open source security news straight to your inbox.