<p>Depends on the installed version of SSL. Please read <a href="https://www.openssl.org/blog/blog/2018/09/11/release111/">https://www.openssl.org/blog/blog/2018/09/11/release111/</a><span style="font-size: 10pt;"> </span></p>

<p>Hi!</p><p><span style="font-size: 10pt;"> is it possible to be added to a beta-tester list, to receive newer beta versions of Mercury as they come out?</span></p><p>Also, I'm currently on "Mercury/32, v4.81.187, Nov 18 2018".  Has a newer beta than this been created?</p><p><span style="font-size: 10pt;"> Thanks!</span></p>

In particular, I'm interested in a newer version of SSL, which will avoid the weak DES-CBC3 cipher, and SSLv3 on imaps.  Note that aside from that, the last beta Rolf provided seems to be working great.  No glitches at all.

<p>There is no new beta in testing at the moment, so the version you have is the latest one. And it works fine here too!</p><p> </p>

<p>In case it's helpful, here is the vulnerability info from scanmyserver.com:</p> <div class="timeline-container" style="color: rgb(57, 57, 57); text-transform: none; text-indent: 0px; letter-spacing: normal; padding-top: 4px; font-family: Roboto, sans-serif; font-size: 13px; font-style: normal; font-weight: 400; margin-bottom: 32px; word-spacing: 0px; white-space: normal; position: relative; box-sizing: border-box; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-style: initial; text-decoration-color: initial;"><div class="timeline-label" style="margin: 0px 0px 18px 34px; clear: both; display: block; box-sizing: border-box;"><span class="label label-warning arrowed-in-right label-lg" style="padding: 0.3em 0.6em 0.4em; border-radius: 0px; height: 24px; text-align: center; color: rgb(255, 255, 255); line-height: 1.1; font-size: 13px; font-weight: 400; margin-right: 6px; vertical-align: baseline; display: inline-block; white-space: nowrap; position: relative; z-index: 1; box-sizing: border-box; text-shadow: none; background-color: rgb(248, 148, 6);"><strong style="font-weight: 700; box-sizing: border-box;">Medium</strong></span></div><div class="timeline-item clearfix" style="margin-bottom: 8px; position: relative; box-sizing: border-box;"><div class="timeline-info" style="width: 60px; text-align: center; float: left; position: relative; box-sizing: border-box;"><i class="timeline-indicator icon-circle btn btn-warning no-hover" style="margin: 0px; padding: 0px; border-radius: 100%; border: 3px solid rgb(255, 255, 255) !important; transition:background-color 0.15s, border-color 0.15s, opacity 0.15s; border-image: none !important; width: 36px; height: 36px; text-align: center; color: rgb(255, 255, 255) !important; line-height: 30px; font-size: 16px; font-weight: 400; vertical-align: middle; display: inline-block; white-space: nowrap; position: relative; cursor: default; box-sizing: border-box; opacity: 1; box-shadow: none !important; text-shadow: none !important; touch-action: manipulation; background-image: none !important; background-color: rgb(255, 183, 82) !important; user-select: none;"></i></div><div class="widget-box" style="margin: 0px 0px 0px 60px; padding: 0px; border: 1px solid rgb(204, 204, 204); border-image: none; color: rgb(97, 97, 97); position: relative; max-width: none; box-sizing: border-box; box-shadow: none; background-color: rgb(243, 243, 243);"><div class="widget-header header-color-orange widget-header-small" style="background: linear-gradient(rgb(255, 255, 255) 0px, rgb(238, 238, 238) 100%) repeat-x rgb(247, 247, 247); color: rgb(102, 159, 199); padding-left: 10px; border-bottom-color: rgb(221, 221, 221); border-bottom-width: 1px; border-bottom-style: solid; position: relative; min-height: 31px; box-sizing: content-box;"><h5 class="smaller" style="color: inherit; line-height: 1.1; font-family: 'Open Sans', 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-weight: 400; margin-top: 10px; margin-bottom: 10px; box-sizing: border-box;">Sweet32 Birthday Attacks on 64-bit Block Ciphers in TLS and OpenVPN (DES-CBC3)</h5><span class="widget-toolbar" style="padding: 0px 10px; line-height: 29px; float: right; display: inline-block; position: relative; box-sizing: border-box;"><a style="margin: 0px 1px; padding: 0px; transition:transform 0.1s; color: rgb(170, 170, 170); line-height: 24px; font-size: 14px; text-decoration: none; display: inline-block; cursor: pointer; box-sizing: border-box; background-color: transparent;" mce_href="https://scanmyserver.com/my_account/?#" data-action="collapse" href="https://scanmyserver.com/my_account/?#"><i class="ace-icon fa fa-chevron-up" style="text-align: center; line-height: 1; font-family: FontAwesome; font-size: inherit; font-style: normal; font-variant: normal; font-weight: normal; margin-right: 0px; display: inline-block; box-sizing: border-box; font-stretch: normal; text-rendering: auto; -webkit-font-smoothing: antialiased;"></i></a></span></div><div class="widget-body" style="box-sizing: border-box; background-color: transparent;"><div class="widget-main" style="margin: 0px; padding: 12px; border-bottom-width: 0px; position: relative; max-width: none; box-sizing: border-box;"><dl class="dl-horizontal" id="dt-list-1" style="margin-top: 0.5em; margin-bottom: 1em; box-sizing: border-box;"><dt style="width: 160px; text-align: right; line-height: 1.4285; overflow: hidden; clear: left; font-weight: 700; float: left; white-space: nowrap; -ms-text-overflow: ellipsis; box-sizing: border-box;">Summary</dt><dd style="line-height: 1.4285; padding-left: 1em; margin-left: 180px; box-sizing: border-box;">This test detects SSL ciphers DES-CBC3 supported by the remote service for encrypting communications.<br style="box-sizing: border-box;"><br style="box-sizing: border-box;"><div class="output" style="padding: 0.5em; border: 1px solid currentColor; border-image: none; overflow: auto; box-sizing: border-box;">Weak Cipher DES-CBC3 found: (Cipher: EDH-RSA-DES-CBC3-SHA|SSLv3|Kx=DH|Au=RSA|Enc=3DES(168)|Mac=SHA1) (Cipher: DES-CBC3-SHA|SSLv3|Kx=RSA|Au=RSA|Enc=3DES(168)|Mac=SHA1) (Cipher: EDH-RSA-DES-CBC3-SHA|TLSv1|Kx=DH|Au=RSA|Enc=3DES(168)|Mac=SHA1) (Cipher: DES-CBC3-SHA|TLSv1|Kx=RSA|Au=RSA|Enc=3DES(168)|Mac=SHA1)</div></dd><dt style="width: 160px; text-align: right; line-height: 1.4285; overflow: hidden; clear: left; font-weight: 700; float: left; white-space: nowrap; -ms-text-overflow: ellipsis; box-sizing: border-box;">Port</dt><dd style="line-height: 1.4285; padding-left: 1em; margin-left: 180px; box-sizing: border-box;">imaps (993/tcp)</dd><dt style="width: 160px; text-align: right; line-height: 1.4285; overflow: hidden; clear: left; font-weight: 700; float: left; white-space: nowrap; -ms-text-overflow: ellipsis; box-sizing: border-box;">Solution</dt><dd style="line-height: 1.4285; padding-left: 1em; margin-left: 180px; box-sizing: border-box;">See solution found at:<span> </span><a style="color: rgb(51, 122, 183); text-decoration: none; cursor: pointer; box-sizing: border-box; background-color: transparent;" mce_href="https://www.openssl.org/blog/blog/2016/08/24/sweet32/" target="_blank" rel="nofollow" href="https://www.openssl.org/blog/blog/2016/08/24/sweet32/">https://www.openssl.org/blog/blog/2016/08/24/sweet32/</a></dd><dt style="width: 160px; text-align: right; line-height: 1.4285; overflow: hidden; clear: left; font-weight: 700; float: left; white-space: nowrap; -ms-text-overflow: ellipsis; box-sizing: border-box;">External sources</dt><dd style="line-height: 1.4285; padding-left: 1em; margin-left: 180px; box-sizing: border-box;"><a style="color: rgb(51, 122, 183); text-decoration: none; cursor: pointer; box-sizing: border-box; background-color: transparent;" mce_href="https://sweet32.info/" target="_blank" rel="nofollow" href="https://sweet32.info/">https://sweet32.info/</a></dd><dt style="width: 160px; text-align: right; line-height: 1.4285; overflow: hidden; clear: left; font-weight: 700; float: left; white-space: nowrap; -ms-text-overflow: ellipsis; box-sizing: border-box;">CVE</dt><dd style="line-height: 1.4285; padding-left: 1em; margin-left: 180px; box-sizing: border-box;"><a style="color: rgb(51, 122, 183); text-decoration: none; cursor: pointer; box-sizing: border-box; background-color: transparent;" mce_href="http://www.securiteam.com/cgi-bin/cve.pl?cve=CVE-2016-2183" target="_new" href="http://www.securiteam.com/cgi-bin/cve.pl?cve=CVE-2016-2183">CVE-2016-2183</a></dd><dt style="width: 160px; text-align: right; line-height: 1.4285; overflow: hidden; clear: left; font-weight: 700; float: left; white-space: nowrap; -ms-text-overflow: ellipsis; box-sizing: border-box;">Test ID</dt><dd style="line-height: 1.4285; padding-left: 1em; margin-left: 180px; box-sizing: border-box;">19146</dd></dl></div></div></div></div><div class="timeline-item clearfix" style="margin-bottom: 8px; position: relative; box-sizing: border-box;"><div class="timeline-info" style="width: 60px; text-align: center; float: left; position: relative; box-sizing: border-box;"><i class="timeline-indicator icon-circle btn btn-warning no-hover" style="margin: 0px; padding: 0px; border-radius: 100%; border: 3px solid rgb(255, 255, 255) !important; transition:background-color 0.15s, border-color 0.15s, opacity 0.15s; border-image: none !important; width: 36px; height: 36px; text-align: center; color: rgb(255, 255, 255) !important; line-height: 30px; font-size: 16px; font-weight: 400; vertical-align: middle; display: inline-block; white-space: nowrap; position: relative; cursor: default; box-sizing: border-box; opacity: 1; box-shadow: none !important; text-shadow: none !important; touch-action: manipulation; background-image: none !important; background-color: rgb(255, 183, 82) !important; user-select: none;"></i></div><div class="widget-box" style="margin: 0px 0px 0px 60px; padding: 0px; border: 1px solid rgb(204, 204, 204); border-image: none; color: rgb(89, 92, 102); position: relative; max-width: none; box-sizing: border-box; box-shadow: none; background-color: rgb(242, 246, 249);"><div class="widget-header header-color-orange widget-header-small" style="background: linear-gradient(rgb(255, 255, 255) 0px, rgb(238, 238, 238) 100%) repeat-x rgb(247, 247, 247); color: rgb(102, 159, 199); padding-left: 10px; border-bottom-color: rgb(221, 221, 221); border-bottom-width: 1px; border-bottom-style: solid; position: relative; min-height: 31px; box-sizing: content-box;"><h5 class="smaller" style="color: inherit; line-height: 1.1; font-family: 'Open Sans', 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-weight: 400; margin-top: 10px; margin-bottom: 10px; box-sizing: border-box;">Deprecated SSL Protocol Usage</h5><span class="widget-toolbar" style="padding: 0px 10px; line-height: 29px; float: right; display: inline-block; position: relative; box-sizing: border-box;"><a style="margin: 0px 1px; padding: 0px; transition:transform 0.1s; color: rgb(170, 170, 170); line-height: 24px; font-size: 14px; text-decoration: none; display: inline-block; cursor: pointer; box-sizing: border-box; background-color: transparent;" mce_href="https://scanmyserver.com/my_account/?#" data-action="collapse" href="https://scanmyserver.com/my_account/?#"><i class="ace-icon fa fa-chevron-up" style="text-align: center; line-height: 1; font-family: FontAwesome; font-size: inherit; font-style: normal; font-variant: normal; font-weight: normal; margin-right: 0px; display: inline-block; box-sizing: border-box; font-stretch: normal; text-rendering: auto; -webkit-font-smoothing: antialiased;"></i></a></span></div><div class="widget-body" style="box-sizing: border-box; background-color: transparent;"><div class="widget-main" style="margin: 0px; padding: 12px; border-bottom-width: 0px; position: relative; max-width: none; box-sizing: border-box;"><dl class="dl-horizontal" id="dt-list-1" style="margin-top: 0.5em; margin-bottom: 1em; box-sizing: border-box;"><dt style="width: 160px; text-align: right; line-height: 1.4285; overflow: hidden; clear: left; font-weight: 700; float: left; white-space: nowrap; -ms-text-overflow: ellipsis; box-sizing: border-box;">Summary</dt><dd style="line-height: 1.4285; padding-left: 1em; margin-left: 180px; box-sizing: border-box;">The remote service accepts connections encrypted using SSLv2 and/or SSLv3, which reportedly suffers from several cryptographic flaws and has been deprecated for several years. An attacker may be able to exploit these issues to conduct man-in-the-middle attacks or decrypt communications between the affected service and clients.<br style="box-sizing: border-box;"><br style="box-sizing: border-box;"><div class="output" style="padding: 0.5em; border: 1px solid currentColor; border-image: none; overflow: auto; box-sizing: border-box;">SSLv3</div></dd><dt style="width: 160px; text-align: right; line-height: 1.4285; overflow: hidden; clear: left; font-weight: 700; float: left; white-space: nowrap; -ms-text-overflow: ellipsis; box-sizing: border-box;">Port</dt><dd style="line-height: 1.4285; padding-left: 1em; margin-left: 180px; box-sizing: border-box;">imaps (993/tcp)</dd><dt style="width: 160px; text-align: right; line-height: 1.4285; overflow: hidden; clear: left; font-weight: 700; float: left; white-space: nowrap; -ms-text-overflow: ellipsis; box-sizing: border-box;">Solution</dt><dd style="line-height: 1.4285; padding-left: 1em; margin-left: 180px; box-sizing: border-box;">Consult the application's documentation to disable SSL 2.0 and SSL 3.0, and use TLS 1.0 or newer.</dd><dt style="width: 160px; text-align: right; line-height: 1.4285; overflow: hidden; clear: left; font-weight: 700; float: left; white-space: nowrap; -ms-text-overflow: ellipsis; box-sizing: border-box;">External sources</dt><dd style="line-height: 1.4285; padding-left: 1em; margin-left: 180px; box-sizing: border-box;"><a style="color: rgb(51, 122, 183); text-decoration: none; cursor: pointer; box-sizing: border-box; background-color: transparent;" mce_href="http://www.schneier.com/paper-ssl.pdf" target="_blank" rel="nofollow" href="http://www.schneier.com/paper-ssl.pdf">http://www.schneier.com/paper-ssl.pdf</a></dd><dt style="width: 160px; text-align: right; line-height: 1.4285; overflow: hidden; clear: left; font-weight: 700; float: left; white-space: nowrap; -ms-text-overflow: ellipsis; box-sizing: border-box;">Test ID</dt><dd style="line-height: 1.4285; padding-left: 1em; margin-left: 180px; box-sizing: border-box;">9329</dd></dl></div></div></div></div></div><div class="timeline-container" style="color: rgb(57, 57, 57); text-transform: none; text-indent: 0px; letter-spacing: normal; padding-top: 4px; font-family: Roboto, sans-serif; font-size: 13px; font-style: normal; font-weight: 400; margin-bottom: 0px; word-spacing: 0px; white-space: normal; position: relative; box-sizing: border-box; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-style: initial; text-decoration-color: initial;"><div class="timeline-label" style="margin: 0px 0px 18px 34px; clear: both; display: block; box-sizing: border-box;"><span class="label label-info arrowed-in-right label-lg" style="padding: 0.3em 0.6em 0.4em; border-radius: 0px; height: 24px; text-align: center; color: rgb(255, 255, 255); line-height: 1.1; font-size: 13px; font-weight: 400; margin-right: 6px; vertical-align: baseline; display: inline-block; white-space: nowrap; position: relative; z-index: 1; box-sizing: border-box; text-shadow: none; background-color: rgb(58, 135, 173);"><strong style="font-weight: 700; box-sizing: border-box;">Low</strong></span></div></div>

Hmm. Either copying newer openssl files and hoping nothing breaks or anybody knows the config setting (found in mercury.ini only "SSL_Mode : 3"). The best solution in my case was using Stunnel.

I've thought of using stunnel, but since it makes all of the connections in the log look like they're coming from the server itself, it breaks some log security processing that I have in place.  It really just needs to be updated.

<p>It really just needs to be updated....and that's the problem. There is a beta version since weeks (months, i dont know) but not for the public and this means either there are parts not ready for release or there is nobody that can do bugfixing in short times in case of something is found to be broken (bug and/or security problem).</p><p>I really love the Mercury32 and also the Sambar server but maybe I have to think seriously about switching the OS, again. I have done this every year in the past and until now the decision was ever "change nothing".</p>

Unfortunately this issue is with the latest beta, but fortunately I *think* it will be an easy fix (assuming the changes between ssl libraries don't interfere too much).