Emmanuel Lécharny created DIRMINA-1203:
------------------------------------------
Summary: Trust-all BogusTrustManagerFactory ships in the
production artifact
Key: DIRMINA-1203
URL: https://issues.apache.org/jira/browse/DIRMINA-1203
Project: MINA
Issue Type: Bug
Affects Versions: 2.2.9
Reporter: Emmanuel Lécharny
Fix For: 2.2.10
During integration testing an embedder sets
sslContextFactory.setTrustManagerFactory(new BogusTrustManagerFactory()) to
talk to a staging server with a self-signed cert, and the line survives into
production.
An attacker on a coffee-shop network MITMs the client's connection with an
openssl-generated self-signed certificate; checkServerTrusted returns without
examining it, the handshake completes, and credentials on the 'secured' session
are captured.
Nothing logs or fails — the connection simply works, which is why the class
keeps getting promoted.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
