RHBA-2009:1365 - Bug Fix Advisory

Topic

An update mod_nss package that fixes a bug in proxy handling is now
available.

Description

mod_nss provides strong cryptography for the Apache Web server via the
Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols,
using the Network Security Services (NSS) security library.

This update addresses a proxy handling bug in mod_nss. mod_nss was not
handling blocked reads properly. Rather than attempting the read again,
it failed with an "End of File" message. When used with mod_proxy in a
reverse proxy configuration, this would sometimes result in returning only
part of the remote content. (Bugzilla #484380)

mod_proxy has a single API for SSL handling, and mod_nss doesn't
register to handle SSL proxy requests if mod_ssl is loaded. In order for
mod_nss to work with mod_proxy, mod_ssl must be removed or disabled. It can
be disabled in one of two ways:

• By removing the mod_ssl package
• By removing or renaming /etc/httpd/conf.d/ssl.conf

Apache users requiring SSL and TLS cryptography are advised to install this
updated package.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 484380 - SSL (reverse) proxy flaky
• BZ - 489013 - mod_nss does not work with NSS 3.12 for pki-ra or pki-tps

CVEs

(none)

References

(none)