diff --git a/rhn/SSL.py b/rhn/SSL.py
index f8a85bc..9b3c83b 100644
--- a/rhn/SSL.py
+++ b/rhn/SSL.py
@@ -89,6 +89,8 @@ class SSLSocket:
self._check_closed()
# Get a context
self._ctx = SSL.Context(self._ssl_method)
+ self._ctx.set_options(SSL.OP_NO_SSLv2)
+ self._ctx.set_options(SSL.OP_NO_SSLv3)
if self._trusted_certs:
# We have been supplied with trusted CA certs
for f in self._trusted_certs:
diff --git a/rhnlib.spec b/rhnlib.spec
index 1581072..1d197e9 100644
--- a/rhnlib.spec
+++ b/rhnlib.spec
@@ -7,7 +7,7 @@
Summary: Python libraries for the Spacewalk project
Name: rhnlib
Version: 2.8.6
-Release: 4%{?dist}
+Release: 5%{?dist}
URL: https://github.com/spacewalkproject/spacewalk
Source0: https://github.com/spacewalkproject/spacewalk/archive/%{name}-%{version}.tar.gz
@@ -74,6 +74,10 @@ make -f Makefile.rhnlib
%endif
%changelog
+* Fri Nov 02 2018 Tomas Kasparek <tkasparek@redhat.com> 2.8.6-5
+- Resolves: #1643415 - forbid old SSL versions during negotiation
+ (tkasparek@redhat.com)
+
* Tue Apr 17 2018 Tomas Kasparek <tkasparek@redhat.com> 2.8.6-4
- don't package python2 files for rhnlib (tkasparek@redhat.com)
- be compliant with new packaging guidelines when requiring python2 packages