Re: [sage-devel] About SSLv3 security hole

2014-12-09 Thread Jori Mantysalo
On Fri, 5 Dec 2014, Jan Groenewald wrote: Please test the fix and report back here: sagenb-0.11.1-py2.7.egg/sagenb/notebook/run_notebook.py: ssl_context = SSL.Context(SSL.SSLv23_METHOD) to ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLSv1) This does not make any differ

Re: [sage-devel] About SSLv3 security hole

2014-12-05 Thread Jan Groenewald
Hi Jori, Please test the fix and report back here: sagenb-0.11.1-py2.7.egg/sagenb/notebook/run_notebook.py: > ssl_context = SSL.Context(SSL.SSLv23_METHOD) > > to > > ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLSv1) > Regards, Jan On 5 December 2014 at 15:21, Volker Braun wrote: > SSLv3 has

Re: [sage-devel] About SSLv3 security hole

2014-12-05 Thread Volker Braun
SSLv3 has been obsolete this entire millennium ;-) On Friday, December 5, 2014 1:16:15 PM UTC, kcrisman wrote: > > We can do this if need be, assuming we have the right stuff. Can someone >> explain to me what the drawbacks would be? (E.g., Volker seems to indicate >> that IE6 can only use SSL

Re: [sage-devel] About SSLv3 security hole

2014-12-05 Thread kcrisman
> > > I agree with forcing always TLS in the notebook, screw IE6. > > sagenb-0.11.1-py2.7.egg/sagenb/notebook/run_notebook.py: >> ssl_context = SSL.Context(SSL.SSLv23_METHOD) >> >> to >> >> ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLSv1) >> > > > We can do this if need be, assuming we have

Re: [sage-devel] About SSLv3 security hole

2014-12-05 Thread Volker Braun
There is no Python 2.7.9 yet, this is upstream WIP. I agree with forcing always TLS in the notebook, screw IE6. On Friday, December 5, 2014 7:49:52 AM UTC, Jan Groenewald wrote: > > sagenb-0.11.1-py2.7.egg/sagenb/notebook/run_notebook.py: > ssl_context = SSL.Context(SSL.SSLv23_METHOD) > > to

Re: [sage-devel] About SSLv3 security hole

2014-12-04 Thread Jan Groenewald
Hi I'm not sure, but perhaps if you change this: 0 root@muizenberg:/usr/lib/ sagemath/local/lib/python2.7/site-packages#grep -r SSLv23 * sagenb-0.11.1-py2.7.egg/sagenb/notebook/run_notebook.py: ssl_context = SSL.Context(SSL.SSLv23_METHOD) to ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLSv1) See

Re: [sage-devel] About SSLv3 security hole

2014-12-04 Thread Jori Mantysalo
On Thu, 4 Dec 2014, Jan Groenewald wrote: Depend on the proper version high enough of openssl and it is fixed for you. (assuming sage server side) On client side your browser, say, firefox34, latest chrome, it is fixed. What situation is this for? A server for Tampere university? What version

Re: [sage-devel] About SSLv3 security hole

2014-12-04 Thread Jan Groenewald
Hi https://docs.python.org/2.7/library/ssl.html#ssl.OP_NO_SSLv3 says "New in version 2.7.9" and it looks like sage runs 2.7.8 (sage-sh) root@muizenberg:python2.7$ python --version Python 2.7.8 Once 2.7.9 is included, I think we can add here, for example: 0 root@muizenberg:/usr/lib/sagemath/loc

Re: [sage-devel] About SSLv3 security hole

2014-12-04 Thread kcrisman
> > > > Depend on the proper version high enough of openssl and it is fixed for > you. (assuming sage server side) > On client side your browser, say, firefox34, latest chrome, it is fixed. > > What situation is this for? A server for Tampere university? What version > of openssl runs on which

Re: [sage-devel] About SSLv3 security hole

2014-12-04 Thread Jan Groenewald
Hi Depend on the proper version high enough of openssl and it is fixed for you. (assuming sage server side) On client side your browser, say, firefox34, latest chrome, it is fixed. What situation is this for? A server for Tampere university? What version of openssl runs on which OS? PS. I stayed

[sage-devel] About SSLv3 security hole

2014-12-04 Thread Jori Mantysalo
Anyone knows how for fix SSLv3 hole on Sage? See http://trac.sagemath.org/ticket/17164 . -- Jori Mäntysalo