[
https://issues.apache.org/jira/browse/OFBIZ-5848?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14196357#comment-14196357
]
Hrc Boston commented on OFBIZ-5848:
-----------------------------------
Hi there--you can follow this thread here which I have been updating. Right
now, we are thinking of using our network to somehow not use sslv3 as we are
hitting a block with ofbiz itself.
http://ofbiz.135035.n4.nabble.com/Re-Ofbiz-09-04-piddle-bleed-fix-td4657772.html#a4657792
I wonder if this ticket is worth addressing for newer versions well?
ofbiz an ecommerce platform so this is going to be an important issue for
anyone using external companies to pass sensetive data to... over https...
I noticed that this site has sslv3 enabled and also uses ofbiz.... several
others have this problem as well.
openssl s_client -connect www.purityproducts.com:443 -ssl3
anyway, food for thought.
RD
> Poodle-disable sslv3
> --------------------
>
> Key: OFBIZ-5848
> URL: https://issues.apache.org/jira/browse/OFBIZ-5848
> Project: OFBiz
> Issue Type: Bug
> Affects Versions: Trunk
> Environment: unix
> Reporter: Hrc Boston
> Priority: Critical
> Labels: patch, security
>
> Hi there--
> This topic seemed relevant because it is a major security issue that recently
> came up and will affect many ecommerce sites for ofbiz.
> I am in process of trying to disable sslv3 on our version of of
> ofbiz 09-04, which uses tomcat 6.
> This is to eliminate the security vulnerability from poodle bleed.
> http://www.symantec.com/connect/blogs/ssl-30-vulnerability-poodle-bug-aka-poodlebleed
> We have tried updating the of ofbiz-containers.xml file like below, but it
> did not disable sslv3. Poodle is still there.
> I have also seen fixes that update server.xml with something similar.
> <property name="sslProtocol" value="TLS"/>
> <property name="sslEnabledProtocols" value="TLSv1"/>
> Has anyone else had luck fixing the poodle issue on Apache ofbiz version
> 09-04?
> Or in any of biz products… where is the best place to fix this in of biz??
> Thanks!
> The Poodle fixer :)
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
