Re: SSL / TLS compression | SPDY service|CVE-2012-4929

2015-03-28 Thread Christopher Schultz
-into the SPDY protocol. - -chris From: Ognjen Blagojevic [ognjen.d.blagoje...@gmail.com] Sent: Friday, March 27, 2015 8:34 PM To: Tomcat Users List Subject: Re: SSL / TLS compression | SPDY service|CVE-2012-4929 Rahul, On 27.3.2015 14:42, Rahul Kumar

Re: SSL / TLS compression | SPDY service|CVE-2012-4929

2015-03-28 Thread André Warnier
List Subject: Re: SSL / TLS compression | SPDY service|CVE-2012-4929 Rahul, On 27.3.2015 14:42, Rahul Kumar Singh wrote: So how to disable compression and / or the SPDY service in tomcat6. If you are using JSSE connectors (BIO/NIO/NIO2), compression is already disabled because JSSE does

SSL / TLS compression | SPDY service|CVE-2012-4929

2015-03-27 Thread Rahul Kumar Singh
Hello Tomcat support team, Thanks for your continuous support. Problem : Security issue | CVE-2012-4929 Overview: The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without properly obfuscating the length of the

Re: SSL / TLS compression | SPDY service|CVE-2012-4929

2015-03-27 Thread Ognjen Blagojevic
Rahul, On 27.3.2015 14:42, Rahul Kumar Singh wrote: So how to disable compression and / or the SPDY service in tomcat6. If you are using JSSE connectors (BIO/NIO/NIO2), compression is already disabled because JSSE does not support it, and there is no support for SPDY protocol on those

Re: SSL / TLS compression | SPDY service|CVE-2012-4929

2015-03-27 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Ognjen, On 3/27/15 11:04 AM, Ognjen Blagojevic wrote: On 27.3.2015 14:42, Rahul Kumar Singh wrote: So how to disable compression and / or the SPDY service in tomcat6. If you are using JSSE connectors (BIO/NIO/NIO2), compression is already

RE: SSL / TLS compression | SPDY service|CVE-2012-4929

2015-03-27 Thread Rahul Kumar Singh
. From: Ognjen Blagojevic [ognjen.d.blagoje...@gmail.com] Sent: Friday, March 27, 2015 8:34 PM To: Tomcat Users List Subject: Re: SSL / TLS compression | SPDY service|CVE-2012-4929 Rahul, On 27.3.2015 14:42, Rahul Kumar Singh wrote: So how to disable