TL;DR - SSLv2 is vulnerable, use TLS

We have received notification from the of the DROWN Vulnerability - Decrypting RSA using Obsolete and Weakened eNcryption) , AKA CVE-2016-0800 :

Although there is much hype around such vulnerabilities it is rated as IMPORTANT and seems serious enough for us to send out this notification particularly as the tester identifies weak SSL configurations / vulnerable library versions which may be subject to other vulnerabilities. Please see this drownattack.com to see if you are vulnerableYou should test your domains at the above site and mitigate if necessary.

Mitigation

If you discover a problem affecing one or more web serivces at your site, the CSIRT recommends the following action for mitigation :

… mitigation involves disabling support for SSLv2 and possibly updating SSL libraries (e.g. OpenSSL).Shared keys/certificates with a vulnerable server also present a risk.

AAROC DevOps Vulnerability and Mitigation

We do not currently have a check in our DevOps repo for the Ansible or Puppet configurations of services such as the web interface for the IdP. There is no proactive monitoring of this vulnerabity. If necessary, a playbook to apply mitigation strategies could be developed.

This vulnerability should not have been introduced by any AAROC playbooks, since the web services orchestrated by our Ansible roles explicitly disable SSLv2 :

                  
                    grep -ir sslv2 
                    *
                    Ansible/roles/glassfish/templates/etc/httpd/conf.d/virtualhost.conf.j2:# 
                    connect.  Disable SSLv2 access by default:Ansible/roles/glassfish/templates/etc/httpd/conf.d/virtualhost.conf.j2:#SSLProtocol all -SSLv2Ansible/roles/glassfish/templates/etc/httpd/conf.d/virtualhost.conf.j2:#SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW
                    Ansible/roles/glassfish/tem.conf:# 
                    connect.  Disable SSLv2 access by default:Ansible/roles/glassfish/tem.conf:#SSLProtocol all -SSLv2Ansible/roles/glassfish/tem.conf:#SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW
                    Ansible/roles/glassfish/files/etc/httpd/conf.d/virtualhost.conf:# 
                    connect.  Disable SSLv2 access by default:Ansible/roles/glassfish/files/etc/httpd/conf.d/virtualhost.conf:#SSLProtocol all -SSLv2Ansible/roles/glassfish/files/etc/httpd/conf.d/virtualhost.conf:#SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW
                    Ansible/roles/liferay-csgf/templates/etc/virtualhost.conf.j2:# 
                    connect.  Disable SSLv2 access by default:Ansible/roles/liferay-csgf/templates/etc/virtualhost.conf.j2:#SSLProtocol all -SSLv2Ansible/roles/liferay-csgf/templates/etc/virtualhost.conf.j2:#SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOWAnsible/roles/fts/files/etc/httpd/conf.d/webfts.conf:  SSLProtocol all -SSLv2Ansible/roles/fts/files/etc/httpd/conf.d/webfts.conf:  SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW
                  
                

For more info, contact the .

Thanks to Roderick Mooi from SANREN CSIRT for the heads-up.