[FTPSERVER-459] Allow SSL protocol selection so SSL 3.0 can be turned off due to the Poodle attack vector

• Type: Bug
• Status: Open
• Priority: Critical
• Resolution: Unresolved
• Affects Version/s: 1.0.6
• Component/s: Core
• Assignee: Unassigned
• Reporter: Greg Woolsey
• Created: 27/Oct/14 23:24
• Updated: 22/Jan/15 12:21

Description

Per this US-CERT alert SSL 3.0 should no longer be used.

Apache Mina supports setting the allowed protocols via the setEnabledProtocols() method of SslFilter.

However, There is currently no way I can see to access the filter or affect its creation and initialization in this regard.

FTP Server needs another attribute for SslConfiguration similar to the existing getEnabledCipherSuites() for getEnabledProtocols.

This doesn't look too hard to implement, but I can't see any way to do it without modifying the FTP server code.