[OOZIE-2034] Disable SSLv3 (POODLEbleed vulnerability)

• Type: Bug
• Status: Closed
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 4.0.1
• Fix Version/s: 4.1.0
• Component/s: security
• Assignee: Robert Kanter
• Reporter: Robert Kanter
• Created: 16/Oct/14 19:35
• Updated: 09/Dec/14 00:44
• Resolved: 11/Nov/14 23:35

Description

We should disable SSLv3 to protect against the POODLEbleed vulnerability.
See CVE-2014-3566

We have sslProtocol="TLS" set to only allow TLS in ssl-server.xml, but when I checked, I could still connect with SSLv3. From what I can tell, there's some ambiguity in the tomcat configs between sslProtocol, sslProtocols, and sslEnabledProtocols so we probably have the wrong thing here.

Issue Links

• is related to: OOZIE-2037 Add TLSv1.1,TLSv1.2