[arch-general] Heads up: If you are using SSLv2 turn it off immediately

[P. A. López-Valencia]

If you are have a web server facing the public internet, turn off SSLv2 
immediately. OpenSSL 1.0.2g has the fix but it will take a while to drip 
down to the repos as it brings with it an ABI change.

The vulnerability is so bad[1], it doesn't only have a CVE number, 
CVE-2016-0800[4], but a name and its own website: HTTPS DROWN[1][2][3]. 
One third of all public web servers are open to attack[2][3] and OpenSSL 
may not be the only crypto library affected[1][4].



[1] http://www.theregister.co.uk/2016/03/01/drown_tls_protocol_flaw/

[2] http://www.theregister.co.uk/2016/03/01/drown_crypto_flaw_analysis/

[3] https://drownattack.com/#paper

[4] https://access.redhat.com/security/cve/cve-2016-0800

-- 
Pedro A. López-Valencia
http://about.me/palopezv/
Recession is when a neighbor loses his job. Depression is when you lose 
yours. -Ronald Reagan