[KYLIN-4477] Usage of "TLS" is insecure

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: v3.1.0
• Sprint: Sprint 52
• Assignee: Md Mahir Asef Kabir
• Reporter: Md Mahir Asef Kabir
• Created: 04/May/20 01:42
• Updated: 10/Jul/20 12:20
• Resolved: 12/Jun/20 06:58

Description

Vulnerability Description: In “engine-mr/src/main/java/org/apache/kylin/engine/mr/common/DefaultSslProtocolSocketFactory.java” file the following code was written in

private static SSLContext createEasySSLContext()

method -

SSLContext context = SSLContext.getInstance("TLS");

The vulnerability is, using "TLS” as the argument to SSLContext.getInstance method.

Reason it’s vulnerable: TLS 1.0 is vulnerable to man-in-the-middle attacks. For further reference, follow this.

Suggested Fix: Using

SSLContext.getInstance("TLSv1.3").

Feedback: Please select any of the options down below to help us get an idea about how you felt about the suggestion -

1. Liked it and will make the suggested changes
2. Liked it but happy with the existing version
3. Didn’t find the suggestion helpful