Uploaded image for project: 'Thrift'
  1. Thrift
  2. THRIFT-3639

C# Thrift library forces TLS 1.0, thwarting TLS 1.2 usage

    XMLWordPrintableJSON

Details

    • Bug
    • Status: Closed
    • Critical
    • Resolution: Fixed
    • 0.9.3
    • 0.10.0
    • C# - Library
    • None

    Description

      TTLSSocket.cs.setupTLS() uses SslProtocols.Tls, which forces TLS 1.0. I suspect this was originally done to prevent SSLv2 from working against a poorly configured server, but now prevents working against a TLS 1.2 server, thus decreasing security.

      Since PCI-DSS requires removing anything less than TLS 1.2 by June, this is a critical issue for those of us working in that environment.

      Thanks!

      Attachments

        Activity

          People

            Unassigned Unassigned
            cott@internetstaff.com Cott Lang
            Votes:
            0 Vote for this issue
            Watchers:
            5 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: