Re: [SECURITY] CVE-2009-3555 SSL Man-In-The-Middle attack - Status update

2009-12-16 Thread Mark Thomas
On 16/12/2009 20:05, Timir Hazarika wrote: > Never mind - I just figured out what text modifications went into that > revision. > > Mark, any news on 6.0.21 timelines ? Up for release vote yet ? Nothing certain but should be soon. Keep an eye on the dev list for any news on tags, release votes et

Re: [SECURITY] CVE-2009-3555 SSL Man-In-The-Middle attack - Status update

2009-12-16 Thread Timir Hazarika
Never mind - I just figured out what text modifications went into that revision. Mark, any news on 6.0.21 timelines ? Up for release vote yet ? Thanks, Timir On Wed, Dec 16, 2009 at 11:45 PM, Timir Hazarika wrote: > Mark, I can't seem to find the newer patch, could you share a link please ? > >

Re: [SECURITY] CVE-2009-3555 SSL Man-In-The-Middle attack - Status update

2009-12-16 Thread Timir Hazarika
Mark, I can't seem to find the newer patch, could you share a link please ? Thanks, Timir On Wed, Dec 16, 2009 at 9:42 PM, Mark Thomas wrote: > On 16/12/2009 14:29, Timir Hazarika wrote: > > Guys, > > > > I just tried patching 6.0.20 with the tomcat6 fix mentioned at > > http://www.mail-archive

Re: [SECURITY] CVE-2009-3555 SSL Man-In-The-Middle attack - Status update

2009-12-16 Thread Mark Thomas
On 16/12/2009 14:29, Timir Hazarika wrote: > Guys, > > I just tried patching 6.0.20 with the tomcat6 fix mentioned at > http://www.mail-archive.com/users@tomcat.apache.org/msg70131.html > > This gives me a concurrentmodificationexception: > While this does seem to resolve concurrent modificati

[SECURITY] CVE-2009-3555 SSL Man-In-The-Middle attack - Status update

2009-12-16 Thread Timir Hazarika
Guys, I just tried patching 6.0.20 with the tomcat6 fix mentioned at http://www.mail-archive.com/users@tomcat.apache.org/msg70131.html This gives me a concurrentmodificationexception: java.util.ConcurrentModificationException at java.util.HashMap$HashIterator.nextEntry(Unknown Source)

[SECURITY] CVE-2009-3555 SSL Man-In-The-Middle attack - Status update

2009-11-20 Thread Mark Thomas
Overview The purpose of this update is provide information on the current understanding so users are better informed when making decisions regarding risk mitigation for this issue in their environment. Work on the root cause is progressing but is still in a state of flux. Discussion is f

[SECURITY] CVE-2009-3555 SSL Man-In-The-Middle attack

2009-11-09 Thread Mark Thomas
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 A vulnerability in the TLS protocol has recently been made public [1] that allows an attacker to inject arbitrary requests into an TLS stream. The current understanding of the Tomcat developers is as follows: BIO & NIO connectors using JSSE These c