You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@qpid.apache.org by "Brant Knudson (JIRA)" <ji...@apache.org> on 2015/04/10 17:02:12 UTC
[jira] [Updated] (QPID-6490) Configure SSL ciphers
[ https://issues.apache.org/jira/browse/QPID-6490?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Brant Knudson updated QPID-6490:
--------------------------------
Description:
qpid-cpp must allow an admin to set the SSL ciphers / protocols that they want the server to allow. The default should be ciphers / protocols that don't have known security vulnerabilities like SSLv3 (POODLE) and RC4 ciphers (Bar Mitzvah)
With CVE-2015-2808 (a.k.a. Bar Mitzvah affecting RC4 ciphers) and other recent vulnerabilities found in different ciphers / protocols, we need to be able to disable ciphers / protocols easily.
was:
qpid-cpp must allow an admin to set the SSL ciphers / protocols that they want the server to allow. The default should be ciphers / protocols that are known to be secure.
With CVE-2015-2808 (Bar Mitzvah affecting RC4 ciphers) and other recent vulnerabilities found in different ciphers / protocols, we need to be able to disable ciphers / protocols easily.
> Configure SSL ciphers
> ---------------------
>
> Key: QPID-6490
> URL: https://issues.apache.org/jira/browse/QPID-6490
> Project: Qpid
> Issue Type: Bug
> Components: C++ Broker
> Affects Versions: 0.30
> Environment: Linux
> Reporter: Brant Knudson
> Labels: security
>
> qpid-cpp must allow an admin to set the SSL ciphers / protocols that they want the server to allow. The default should be ciphers / protocols that don't have known security vulnerabilities like SSLv3 (POODLE) and RC4 ciphers (Bar Mitzvah)
> With CVE-2015-2808 (a.k.a. Bar Mitzvah affecting RC4 ciphers) and other recent vulnerabilities found in different ciphers / protocols, we need to be able to disable ciphers / protocols easily.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@qpid.apache.org
For additional commands, e-mail: dev-help@qpid.apache.org