[ https://issues.apache.org/jira/browse/DERBY-6764?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14197046#comment-14197046 ]
Knut Anders Hatlen commented on DERBY-6764: ------------------------------------------- Thanks for fixing this. Note, though, that there were two occurrences of {{(removeTwoProtocols.length)-1}} (both when allocating the new array and when calling arraycopy), and the patch only changed one of them (in the call to arraycopy). I think both should be changed for completeness. > analyze impact of poodle security alert on Derby client - server ssl support > ---------------------------------------------------------------------------- > > Key: DERBY-6764 > URL: https://issues.apache.org/jira/browse/DERBY-6764 > Project: Derby > Issue Type: Task > Affects Versions: 10.12.0.0 > Reporter: Myrna van Lunteren > Assignee: Mamta A. Satoor > Fix For: 10.12.0.0 > > Attachments: DERBY6764_patch1_diff.txt, DERBY6764_patch1_stat.txt > > > Recently, a security weakness was found in SSLv3, POODLE: SSLv3 vulnerability > (CVE-2014-3566) > Derby supports ssl between the client and network server. > We should investigate this and decide if we need to change our product, e.g. > to eliminate support for SSL in favor of its successor TLS. -- This message was sent by Atlassian JIRA (v6.3.4#6332)