[jira] [Closed] (OFBIZ-5848) Poodle-disable sslv3

["Jacques Le Roux (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/OFBIZ-5848?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Jacques Le Roux closed OFBIZ-5848.
----------------------------------
       Resolution: Fixed
    Fix Version/s: 13.07.02
                   12.04.06
                   Upcoming Branch
         Assignee: Jacques Le Roux

> Poodle-disable sslv3
> --------------------
>
>                 Key: OFBIZ-5848
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-5848
>             Project: OFBiz
>          Issue Type: Bug
>    Affects Versions: Trunk
>         Environment: unix
>            Reporter: Hrc Boston
>            Assignee: Jacques Le Roux
>            Priority: Critical
>              Labels: patch, security
>             Fix For: Upcoming Branch, 12.04.06, 13.07.02
>
>
> Hi there-- 
> This topic seemed relevant because it is a major security issue that recently came up and will affect many ecommerce sites for ofbiz. 
> I am in process of trying to disable sslv3 on our version of of 
> ofbiz 09-04, which uses tomcat 6. 
> This is to eliminate the security vulnerability from poodle bleed. 
> http://www.symantec.com/connect/blogs/ssl-30-vulnerability-poodle-bug-aka-poodlebleed
> We have tried updating the of ofbiz-containers.xml file like below, but it 
> did not disable sslv3. Poodle is still there. 
> I have also seen fixes that update server.xml with something similar. 
> <property name="sslProtocol" value="TLS"/>  
> <property name="sslEnabledProtocols" value="TLSv1"/>  
> Has anyone else had luck fixing the poodle issue on Apache ofbiz version 
> 09-04? 
> Or in any of biz products… where is the best place to fix this in of biz??
> Thanks! 
> The Poodle fixer :)



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)