Bug 56947 – apache2/hsts setting is not used in univention-letsencrypt.conf

Bug 56947 - apache2/hsts setting is not used in univention-letsencrypt.conf


Summary:	apache2/hsts setting is not used in univention-letsencrypt.conf

Status:	NEW

Product:	UCS
Classification:	Unclassified
Component:	Let's Encrypt
Version:	UCS 5.0
Hardware:	amd64 Linux

Importance:	P5 normal (vote)
Target Milestone:	---
Assigned To:	UCS maintainers
QA Contact:	UCS maintainers

URL:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2023-12-31 19:09 CET by Christian Kowarzik
Modified:	2024-01-02 14:49 CET (History)
CC List:	5 users (show)

See Also:
What kind of report is it?:	Security Issue
What type of bug is this?:	---
Who will be affected by this bug?:	---
How will those affected feel about the bug?:	---
User Pain:
Enterprise Customer affected?:	Yes
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:	2020022421000562
Bug group (optional):	Security
Max CVSS v3 score:	0.0 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N)

Attachments
/etc/univention/templates/files/etc/apache2/sites-available/univention-letsencrypt.conf.patch (1.20 KB, patch) 2023-12-31 19:09 CET, Christian Kowarzik	Details \| Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Christian Kowarzik 2023-12-31 19:09:32 CET

Created attachment 11169 [details]
/etc/univention/templates/files/etc/apache2/sites-available/univention-letsencrypt.conf.patch

+++ This bug was initially created as a clone of Bug #49844 +++

/etc/univention/templates/files/etc/apache2/sites-available/univention-letsencrypt.conf creates separate virtual hosts for each domain in letsencrypt/domains. However it doesn't create Apache configuration for HSTS as /etc/univention/templates/files/etc/apache2/sites-available/ssl.d/10hsts does it for the default SSL virtual host. So HSTS is in fact not activated anymore.

Proposed fix: /etc/univention/templates/files/etc/apache2/sites-available/univention-letsencrypt.conf should include the code from /etc/univention/templates/files/etc/apache2/sites-available/ssl.d/10hsts.

Please find attached patch for proposed fix.

Patch is adapted - from the one provided in Bug #49844 - for UCS 5 as function run_filter now returns bytes.