zookeeper-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Ilya Maykov (JIRA)" <j...@apache.org>
Subject [jira] [Created] (ZOOKEEPER-3195) TLS - disable client-initiated renegotiation
Date Tue, 20 Nov 2018 23:29:00 GMT
Ilya Maykov created ZOOKEEPER-3195:

             Summary: TLS - disable client-initiated renegotiation
                 Key: ZOOKEEPER-3195
                 URL: https://issues.apache.org/jira/browse/ZOOKEEPER-3195
             Project: ZooKeeper
          Issue Type: Improvement
    Affects Versions: 3.6.0, 3.5.5
            Reporter: Ilya Maykov
            Assignee: Ilya Maykov

Client-initiated TLS renegotiation is not secure and exposes the connection to MITM attacks.
Unfortunately, Java's TLS implementation allows it by default. Thankfully, it is easy to disable.

This message was sent by Atlassian JIRA

View raw message