You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@flink.apache.org by "Viktor Vlasov (JIRA)" <ji...@apache.org> on 2018/06/26 07:53:00 UTC
[jira] [Commented] (FLINK-9643) Flink allowing TLS 1.1 in spite of
configuring TLS 1.2
[ https://issues.apache.org/jira/browse/FLINK-9643?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16523368#comment-16523368 ]
Viktor Vlasov commented on FLINK-9643:
--------------------------------------
Hi [~till.rohrmann]! Could you share the way you've used to determine that versions you've pointed are affected? I just tried to check it with 1.5.0 version, and till now I was sure that in 1.5.0 this problem doesn't exist.
> Flink allowing TLS 1.1 in spite of configuring TLS 1.2
> ------------------------------------------------------
>
> Key: FLINK-9643
> URL: https://issues.apache.org/jira/browse/FLINK-9643
> Project: Flink
> Issue Type: Bug
> Components: Security
> Affects Versions: 1.3.2, 1.5.0, 1.4.2, 1.6.0
> Reporter: Vinay
> Assignee: Viktor Vlasov
> Priority: Major
>
> I have deployed Flink 1.3.2 and enabled SSL settings. From the ssl debug
> logs it shows that Flink is using TLSv1.2. However based on the security
> scans we have observed that it also allows TLSv1.0 and TLSv1.1.
>
> In order to strictly use TLSv1.2 we have updated the following property of
> java.security file:
> jdk.tls.disabledAlgorithms=MD5, SSLv3, DSA, RSA keySize < 2048, TLSv1,
> TLSv1.1
> But still it allows TLSv1.1 , verified this by hitting the following command
> from master node:
> openssl s_client -connect taskmanager1:<listening_address_port> -tls1
> (here listening_address_port is part of
> akka.ssl.tcp://flink@taskmanager1:port/user/taskmanager)
> Now, when I hit the above command for the data port, it does not allow
> TLSv1.1 and only allows TLSv1.2
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)