[Pound Mailing List] PCI-DSS Compliance with Pound

Andreas Hilboll <[email protected]> Mon, 29 Apr 2013 09:57:45 +0200

Newsgroups	gmane.comp.web.pound.general
Message-ID	<[email protected]>

Hi,

a recent PCI-DSS scan revealed the following vulnerabilities on our
system:

CVE-2011-3389: SSLv3.0/TLSv1.0 Protocol Weak CBC Mode Vulnerability
CVE-2012-4929: SSL/TLS Compression Algorithm Information Leakage
               Vulnerability

For 2011-3389, I need to disable ciphers deemed unsecure. The solution
for Apache would be this:

   SSLHonorCipherOrder On
   SSLCipherSuite RC4-SHA:HIGH:!ADH

For 2012-4929, I need to turn off SSL Compression.

How can I achieve these two points with Pound 2.6 on Debian Squeeze?

Thanks a lot for your help!
Andreas.

--
To unsubscribe send an email with subject unsubscribe to [email protected]
Please contact [email protected] for questions.