-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 A vulnerability in the TLS protocol has recently been made public [1] that allows an attacker to inject arbitrary requests into an TLS stream.
The current understanding of the Tomcat developers is as follows: BIO & NIO connectors using JSSE These connectors are vulnerable when renegotiation is triggered by the client or the server. Server initiated re-negotiation can be limited by configuration Server initiated re-negotiation could be prevented by a code change Client initiated re-negotiation can not currently be prevented APR/Native connector using OpenSSL Vulnerable when renegotiation is triggered by the client or the server. Server initiated re-negotiation is not supported prior to 1.1.17 Client initiated re-negotiation is supported but can not be prevented OpenSSL 0.9.8l disables all negotiation by default In terms of what this means for users: BIO/NIO - - We haven't yet (we are still looking) found a way to stop client initiated renegotiation. It may be necessary to wait for the JVM vendors to respond. APR/native - - Re-building any version of the APR/native connector with OpenSSL 0.9.8l will protect against this vulnerability but any configurations that require renegotiation will break. - - Version 1.1.17 of the APR/native connector will be released shortly. The binary versions will be built with OpenSSL 0.9.8l which will protect against this vulnerability but configurations that require renegotiation will break. Supporting renegotiation whilst avoiding the vulnerability requires a protocol fix. The Tomcat development team is examining possible work-arounds that may provide an interim solution. These options include porting r833582 from httpd to the APR/native connector which would disable client triggered renegotiation for OpenSSL < 0.9.8l which may help some users who can't easily change their OpenSSL version. If you'd would like to join/follow the work-around discussions, please join the Tomcat dev mailing list. Any significant developments in this area will be posted to the Tomcat announce@ and users@ mailing lists. Mark [1] http://extendedsubset.com/?p=8 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.12 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQIcBAEBCgAGBQJK+Ea6AAoJEBDAHFovYFnnjggP/RU6UpOmXDCzOG/neVmMI0RX XMKMZdpph8TCdjOzOd1UdCGPK5q3U1CDvB7P96eYZ5R745YTT6Ct1hXETC++SAh2 Q6jRD2qNPXX7hA9JFallC6+PUjq+IaHknJQYGAFaHCEdvwocp8NYWxUSqg5yTc6U toUclHntjEwXc6jpEeNwuU3An8WNf2rX5OV9IX17lS7mxtElfVVIM5o4PrkMV0Tn 5i3YpLXTzHIHZ3Wv6VOlsQy+X+JhM4GMWF+4wWgHzdUfQ3wCpUrmC/tOgsXp23j8 ITPqIcf5dsDsOEd9RAZRWoRPpgcJH3bypnmG65VpITRkjnvKq6GC1TcKXTdUBxER 0OwpAY2A/e6OzHpw68q0wn5deYKBEo+6DJ/rFmHCs4KYiw7WXpOQFsL5LXxuDfEr 7W79w1nEPAaXz6KGSGiEuPxyLtJafAP16ZtaITqzoI9Pn1bpl9iP/OK+2OTc/e+/ BF0vI0gh2ZD2AbktNZJLY8+i5FmF/jcJP6/SQLnFQl5AZQ6YhRNQl87bc4lEkZkm IHIdJW28EbD/4V0Yex8MnAFIFEq/jyWe2LgUep0/j9LEkMKlFGpoNNgEQsA9E8ml RR9adgTCESBN6cCCsn5CrYTlsTKyfxk/Db2inI7L/OM3zfQoCTQDFnxY1l13I+Dt FiHrC9dgiTCEZL0fR69F =xrMK -----END PGP SIGNATURE----- --------------------------------------------------------------------- To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional commands, e-mail: users-h...@tomcat.apache.org