[ https://issues.apache.org/jira/browse/DERBY-6764?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14195958#comment-14195958 ]
Knut Anders Hatlen commented on DERBY-6764: ------------------------------------------- {code} if (enabledProtocols[i].toUpperCase().contains("SSLV3") || enabledProtocols[i].toUpperCase().contains("SSLv2Hello")) { {code} Shouldn't {{"SSLv2Hello"}} have been in all upper case? Otherwise, it won't ever match {{enabledProtocols\[i\].toUpperCase()}}. > analyze impact of poodle security alert on Derby client - server ssl support > ---------------------------------------------------------------------------- > > Key: DERBY-6764 > URL: https://issues.apache.org/jira/browse/DERBY-6764 > Project: Derby > Issue Type: Task > Affects Versions: 10.12.0.0 > Reporter: Myrna van Lunteren > Assignee: Mamta A. Satoor > Fix For: 10.12.0.0 > > Attachments: DERBY6764_patch1_diff.txt, DERBY6764_patch1_stat.txt > > > Recently, a security weakness was found in SSLv3, POODLE: SSLv3 vulnerability > (CVE-2014-3566) > Derby supports ssl between the client and network server. > We should investigate this and decide if we need to change our product, e.g. > to eliminate support for SSL in favor of its successor TLS. -- This message was sent by Atlassian JIRA (v6.3.4#6332)