[NIFI-7913] ListenSMTP Allows TLS 1.0 and 1.1 Regardless of TLS Protocol Configured

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.12.0
• Fix Version/s: 1.13.0
• Component/s: Extensions
• Labels: SMTP TLS security
• Environment: Fedora 32 ; OpenJDK 1.8.0_265 ; OpenJDK 11.0.8
• Assignee: David Handermann
• Reporter: David Handermann
• Created: 12/Oct/20 20:48
• Updated: 10/Dec/20 19:44
• Resolved: 10/Dec/20 19:44

Description

ListenSMTP supports TLS communication using a configurable RestrictedSSLContextService as of NIFI-4335.  Regardless of setting the TLS Protocol property to TLS or a specific TLS version, ListenSMTP accepts TLS communication using TLS 1.0 or TLS 1.1 in addition to TLS 1.2, or TLS 1.3 under Java 11.

This can be reproduced at runtime by configuring ListenSMTP with a StandardRestrictedSSLContextService and using the following OpenSSL command to run the STARTTLS command.

For TLS 1.0:

openssl s_client -host localhost -port 2525 -starttls smtp tls1

For TLS 1.1:

openssl s_client -host localhost -port 2525 -starttls smtp tls1_1

The response output should include the negotiated cipher and SSL Session-ID.

This can also be reproduced in unit tests by specifying the mail.smtp.ssl.protocols property with either TLSv1 or TLSv1.1 when configuring the Java Mail Session.

Setting specific enabled protocols on the created SSLSocket should disable legacy TLS protocols.  Resolution should include support for either a specific TLS version, or secure TLS versions based on the runtime Java version.

Issue Links

• links to: GitHub Pull Request #4599