Drown vulnerability

[anatola2]

I use a Listman forum and according to one test, it is vulnerable to Drown.

https://test.drownattack.com/?site=sonic.net

[Guest]

More importantly, ovpn.sonic.net is also allowing SSLv2. I actually migrated from beta to production and specifically told the VPN Connect client to use TLS1.2 but it failed as it wanted a lower version. Changing TLS (Default) made it work.

[kgc]

None of our services should be affected since we've already patched all (potentially) affected systems. In most cases our cipher suite selection prevented the attack in the first place.

I'll double check to make sure that our OpenVPN services are not affected but I don't believe they are.

[anatola2]

Thank you, Kelsey. The drownattack site above now gives our list server a green "appears fixed".