[
https://issues.apache.org/jira/browse/DIRMINA-1203?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Emmanuel Lécharny closed DIRMINA-1203.
--------------------------------------
> Trust-all BogusTrustManagerFactory ships in the production artifact
> -------------------------------------------------------------------
>
> Key: DIRMINA-1203
> URL: https://issues.apache.org/jira/browse/DIRMINA-1203
> Project: MINA
> Issue Type: Bug
> Affects Versions: 2.2.9
> Reporter: Emmanuel Lécharny
> Priority: Minor
> Fix For: 2.2.10
>
>
> During integration testing an embedder sets
> sslContextFactory.setTrustManagerFactory(new BogusTrustManagerFactory()) to
> talk to a staging server with a self-signed cert, and the line survives into
> production.
> An attacker on a coffee-shop network MITMs the client's connection with an
> openssl-generated self-signed certificate; checkServerTrusted returns without
> examining it, the handshake completes, and credentials on the 'secured'
> session are captured.
> Nothing logs or fails — the connection simply works, which is why the class
> keeps getting promoted.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
