enterprise-support team mailing list archive

[Launchpad Bug Tracker <1400473@xxxxxxxxxxxxxxxxxx>]

You have been subscribed to a public bug:

For PCI compliance, one must not be vulnerable to the POODLE or BEAST or
CRIME attacks. POODLE suggests removing  SSLv2 and SSLv3, and BEAST
suggests removing TLSv1. However, since TLSv1.1 and TLSv1.2 do not seem
to be supported by apache 2.2 on 12.04 LTS, and since apache 2.4 on
12.04 LTS does not support PHP 5.3.X, the last branch to allow PHP
register_globals, which is required for lots of legacy production code
often used by sites with payment systems, and since Ubuntu 14.04 LTS
does not support apache 2.2, and since Ubuntu 10.04 LTS does not support
SHA256 signed SSL certificates, there may be no feasible way for someone
to run a credit card processing system with any Ubuntu LTS system if
they require both PCI compliance and PHP register_globals support.

It looks like manually compiling PHP may be the only plausible way to
surmount this issue in this particular circumstance.

** Affects: apache2 (Ubuntu)
     Importance: Undecided
         Status: Confirmed


** Tags: apache2 openssl php tls
-- 
Apache 2.2 on Ubuntu 12.04 LTS only supports TLS1.0 which is vulnerable to BEAST attack
https://bugs.launchpad.net/bugs/1400473
You received this bug notification because you are a member of Ubuntu Server/Client Support Team, which is subscribed to apache2 in Ubuntu.