[JCLOUDS-753] Investigate HttpCommandExecutorService(s) with regards to POODLE

• Type: Bug
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 1.5.10, 1.6.3, 1.7.3, 1.8.0, 1.8.1
• Fix Version/s: 1.9.0
• Component/s: jclouds-core, jclouds-drivers
• Assignee: Unassigned
• Reporter: Diwaker Gupta
• Created: 15/Oct/14 20:40
• Updated: 06/Mar/15 22:29
• Resolved: 06/Mar/15 22:29

Description

SSLModule configures the SSLContext when using "untrusted" configuration:

            sc = SSLContext.getInstance("SSL");
            sc.init(null, new TrustManager[] { trustAllCerts }, new SecureRandom());

This makes the client end of the SSL connection vulnerable to POODLE (http://googleonlinesecurity.blogspot.com/2014/10/this-poodle-bites-exploiting-ssl-30.html)

jclouds should consider enforcing TLS on all client connections, even on ones already susceptible to MITM attacks.

We should also investigate other uses of SSLContext in jclouds.

Sub-Tasks

• Make it easier to configure TLS overrides in apache hc driver: Open