[DERBY-6764] analyze impact of poodle security alert on Derby client - server ssl support

• Type: Task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 10.8.3.0, 10.9.1.0, 10.10.2.0, 10.11.1.1, 10.12.1.1
• Fix Version/s: 10.8.3.3, 10.9.2.2, 10.10.2.1, 10.11.1.3, 10.12.1.1
• Urgency: Urgent
• Bug behavior facts: Security
• Assignee: Mamta A. Satoor
• Reporter: Myrna van Lunteren
• Created: 16/Oct/14 21:38
• Updated: 09/Sep/16 09:53
• Resolved: 03/Dec/14 01:48

Description

Recently, a security weakness was found in SSLv3, POODLE: SSLv3 vulnerability (CVE-2014-3566)
Derby supports ssl between the client and network server.

We should investigate this and decide if we need to change our product, e.g. to eliminate support for SSL in favor of its successor TLS.

Issue Links

• is related to: DERBY-6778 SSL tests are failing on 10.8 codeline with IBM jdk 1.4.2 after poodle security backport