[ https://issues.apache.org/jira/browse/DERBY-6764?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14195849#comment-14195849 ]
Knut Anders Hatlen commented on DERBY-6764: ------------------------------------------- {code} newEnabledProtocolsList = new String[(removeTwoProtocols.length)-1]; System.arraycopy(removeTwoProtocols, 0, newEnabledProtocolsList, 0, (removeTwoProtocols.length)-1); {code} Should {{(removeTwoProtocols.length)-1}} have been {{removedProtocolsCount}} instead? (So that we don't assume that only one protocol was removed.) > analyze impact of poodle security alert on Derby client - server ssl support > ---------------------------------------------------------------------------- > > Key: DERBY-6764 > URL: https://issues.apache.org/jira/browse/DERBY-6764 > Project: Derby > Issue Type: Task > Affects Versions: 10.12.0.0 > Reporter: Myrna van Lunteren > Assignee: Mamta A. Satoor > Fix For: 10.12.0.0 > > Attachments: DERBY6764_patch1_diff.txt, DERBY6764_patch1_stat.txt > > > Recently, a security weakness was found in SSLv3, POODLE: SSLv3 vulnerability > (CVE-2014-3566) > Derby supports ssl between the client and network server. > We should investigate this and decide if we need to change our product, e.g. > to eliminate support for SSL in favor of its successor TLS. -- This message was sent by Atlassian JIRA (v6.3.4#6332)