[HADOOP-11217] Disable SSLv3 in KMS

• Type: Bug
• Status: Closed
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 2.6.0
• Fix Version/s: 2.6.0
• Component/s: kms
• Target Version/s: 2.6.0
• Hadoop Flags: Reviewed
• Assignee: Robert Kanter
• Reporter: Robert Kanter
• Created: 21/Oct/14 21:37
• Updated: 01/Dec/14 03:10
• Resolved: 13/Nov/14 02:43

Description

We should disable SSLv3 in KMS to protect against the POODLEbleed vulnerability.
See CVE-2014-3566

We have sslProtocol="TLS" set to only allow TLS in ssl-server.xml, but when I checked, I could still connect with SSLv3. There documentation is somewhat unclear in the tomcat configs between sslProtocol, sslProtocols, and sslEnabledProtocols and what each value they take does exactly. From what I can gather, sslProtocol="TLS" actually includes SSLv3 and the only way to fix this is to explicitly list which TLS versions we support.

Issue Links

• is related to: HDFS-7274 Disable SSLv3 in HttpFS
• relates to: HADOOP-11218 Add TLSv1.1,TLSv1.2 to KMS, HttpFS, SSLFactory
• relates to: HADOOP-11243 SSLFactory shouldn't allow SSLv3