ofbiz-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Hrc Boston (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (OFBIZ-5848) Poodle-disable sslv3
Date Tue, 04 Nov 2014 18:57:35 GMT

    [ https://issues.apache.org/jira/browse/OFBIZ-5848?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14196606#comment-14196606
] 

Hrc Boston commented on OFBIZ-5848:
-----------------------------------

it was a tomcat6 issue

> Poodle-disable sslv3
> --------------------
>
>                 Key: OFBIZ-5848
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-5848
>             Project: OFBiz
>          Issue Type: Bug
>    Affects Versions: Trunk
>         Environment: unix
>            Reporter: Hrc Boston
>            Priority: Critical
>              Labels: patch, security
>
> Hi there-- 
> This topic seemed relevant because it is a major security issue that recently came up
and will affect many ecommerce sites for ofbiz. 
> I am in process of trying to disable sslv3 on our version of of 
> ofbiz 09-04, which uses tomcat 6. 
> This is to eliminate the security vulnerability from poodle bleed. 
> http://www.symantec.com/connect/blogs/ssl-30-vulnerability-poodle-bug-aka-poodlebleed
> We have tried updating the of ofbiz-containers.xml file like below, but it 
> did not disable sslv3. Poodle is still there. 
> I have also seen fixes that update server.xml with something similar. 
> <property name="sslProtocol" value="TLS"/>  
> <property name="sslEnabledProtocols" value="TLSv1"/>  
> Has anyone else had luck fixing the poodle issue on Apache ofbiz version 
> 09-04? 
> Or in any of biz products… where is the best place to fix this in of biz??
> Thanks! 
> The Poodle fixer :)



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Mime
View raw message