[
https://issues.apache.org/jira/browse/HADOOP-11260?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Mike Yoder updated HADOOP-11260:
--------------------------------
Status: Patch Available (was: Open)
Patch 001 introduces a SslSocketConnectorSecure class which extends
SslSocketConnector. This new class overrides the newServerSocket() call, and
removes any protocol with "SSL" from the socket.
Tested created server connections by hand using openssl s_client and "sslscan".
Verified that SSLv3 is no longer available on the servers.
> Patch up Jetty to disable SSLv3
> -------------------------------
>
> Key: HADOOP-11260
> URL: https://issues.apache.org/jira/browse/HADOOP-11260
> Project: Hadoop Common
> Issue Type: Bug
> Components: security
> Affects Versions: 2.5.1
> Reporter: Karthik Kambatla
> Assignee: Mike Yoder
> Priority: Blocker
> Attachments: HADOOP-11260.001.patch
>
>
> Hadoop uses an older version of Jetty that allows SSLv3. We should fix it up.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
