607004 - Visiting bugzilla.mozilla.org Shows CVE-2009-3555

Status: RESOLVED DUPLICATE of bug 555952

(mozilla.org Graveyard :: Server Operations, task)

Description

[David E. Ross]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.14) Gecko/20100930 SeaMonkey/2.0.9
Build Identifier: 

After logging-on to bugzilla.mozilla.org and viewing some bug reports, I viewed my browser's Error Console.  The Messages contained multiple instances of the following:  
  www.mozilla.org : server does not support RFC 5746, see CVE-2009-3555

Reproducible: Always

Comment 1

[:Gavin Sharp [email: [e-mail]]]

bugzilla itself is fixed, but I guess it links to stuff on www.mozilla.org

Comment 2

[Jean-Marc Desperrier]

It's not strictly talking a duplicate of bug 555952. 

It depends on bug 555952, so far as it would be resolved if bug 555952 is fixed.
But it also depends on bug 481675, in that it would also be fixed if bug 481675 is fixed.

I think bug 481675 deserves to be fixed. Generating https traffic on www.mozilla.org that is in fact deported traffic from bugzilla.mozilla.org is not a good thing.

Comment 3

[David E. Ross]

This bug indicates a configuration problem on the bugzilla.mozilla.org server.  Bug #481675 would make this server independent of the www.mozilla.org server.  If bug #481675 were fixed, it would thus mean fixing bug #555952 would not resolve this problem.  Therefore, this is not a duplicate of bug #555952.

Comment 4

[:Gavin Sharp [email: [e-mail]]]

There's no use tracking this separately - there's no action item for server-ops here. We'll fix one of the two bugs this depends on (or both), and that will take care of this.