BEAST to be patched in NSS

[Miloslav Trmač]

Hello,
On Sat, Oct 19, 2013 at 5:23 PM, Elio Maldonado Batiz
<emaldona at redhat.com> wrote:
> On 10/18/2013 06:54 PM, Elio Maldonado Batiz wrote:
>>
>> On 10/18/2013 12:55 PM, Miloslav Trmač wrote:
>>>
>>> On Wed, Oct 16, 2013 at 10:33 PM, Eric H. Christensen
>>> <sparks at fedoraproject.org> wrote:
>>>>
>>>> Information on this fix is in Bugzilla[1].
>>>
>>> There are >80 packages affected, would it be possible to give the
>>> owners a shorter (and authoritative[1]) version, instead of asking
>>> each maintainer to fish the information out of a bug with 135
>>> comments?
>>>
>>> * Can I test my package right now, before the NSS change lands?  How?
>>> * If I need a workaround, what is the workaround?  (Do I have to set
>>> an environment variable, or is there a way to do it in the API?  If I
>>> do have to set an environment variable, do I have to do it at the very
>>> start before initializing NSS?  Before opening the specific socket?,
>>
>>
>> The update has been now to f20
>> updates-testing.https://admin.fedoraproject.org/updates/FEDORA-2013-19396/nss-3.15.2-2.fc20
>> I could hold it back very shortly give folks time but we really would like
>> this during beta so we get feedback.
>>
>> NSS checks the value of the SSL_CBC_RANDOM_IV_SSL variable and you could
>> programmatically set it to 0 with setenv,for example [1].
<snip>
>> There are >80 packages affected, would it be possible to give the
> It would useful if the list was available.
(repoquery --whatrequires nss).

> Could those package owners be
> notified directly?
That seems useful to me, yes.
    Mirek