[
https://issues.apache.org/jira/browse/OFBIZ-5848?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14196605#comment-14196605
]
Hrc Boston commented on OFBIZ-5848:
-----------------------------------
we had success with this when developing locally:
<property name="sslProtocol" value="TLSv1"/>
<property name="protocols" value="TLSv1"/>
the reason is that it is undoucmented to use protocols instead of
sslEnabledProtocols
see https://blogs.atlassian.com/2014/10/ssl-poodle/
http://tomcat.10.x6.nabble.com/How-to-allow-only-TLS-1-1-connections-to-Tomcat-6-0-server-with-https
we get this when trying to connect with ssl3 locally
openssl s_client -connect localhost:portnumberhere -ssl3
CONNECTED(00000003)
6990:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version
number:/SourceCache/OpenSSL098/OpenSSL098-47.2/src/ssl/s3_pkt.c:290:
> Poodle-disable sslv3
> --------------------
>
> Key: OFBIZ-5848
> URL: https://issues.apache.org/jira/browse/OFBIZ-5848
> Project: OFBiz
> Issue Type: Bug
> Affects Versions: Trunk
> Environment: unix
> Reporter: Hrc Boston
> Priority: Critical
> Labels: patch, security
>
> Hi there--
> This topic seemed relevant because it is a major security issue that recently
> came up and will affect many ecommerce sites for ofbiz.
> I am in process of trying to disable sslv3 on our version of of
> ofbiz 09-04, which uses tomcat 6.
> This is to eliminate the security vulnerability from poodle bleed.
> http://www.symantec.com/connect/blogs/ssl-30-vulnerability-poodle-bug-aka-poodlebleed
> We have tried updating the of ofbiz-containers.xml file like below, but it
> did not disable sslv3. Poodle is still there.
> I have also seen fixes that update server.xml with something similar.
> <property name="sslProtocol" value="TLS"/>
> <property name="sslEnabledProtocols" value="TLSv1"/>
> Has anyone else had luck fixing the poodle issue on Apache ofbiz version
> 09-04?
> Or in any of biz products… where is the best place to fix this in of biz??
> Thanks!
> The Poodle fixer :)
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
