Re: SSL / TLS compression | SPDY service|CVE-2012-4929

2015-03-28 Thread Christopher Schultz
PDY compression, since it's built-into the SPDY protocol. - -chris > From: Ognjen Blagojevic > [ognjen.d.blagoje...@gmail.com] Sent: Friday, March 27, 2015 8:34 > PM To: Tomcat Users List Subject: Re: SSL / TLS compression | SPDY > service

Re: SSL / TLS compression | SPDY service|CVE-2012-4929

2015-03-28 Thread André Warnier
Users List Subject: Re: SSL / TLS compression | SPDY service|CVE-2012-4929 Rahul, On 27.3.2015 14:42, Rahul Kumar Singh wrote: So how to disable compression and / or the SPDY service in tomcat6. If you are using JSSE connectors (BIO/NIO/NIO2), compression is already disabled because JSSE doe

RE: SSL / TLS compression | SPDY service|CVE-2012-4929

2015-03-27 Thread Rahul Kumar Singh
. From: Ognjen Blagojevic [ognjen.d.blagoje...@gmail.com] Sent: Friday, March 27, 2015 8:34 PM To: Tomcat Users List Subject: Re: SSL / TLS compression | SPDY service|CVE-2012-4929 Rahul, On 27.3.2015 14:42, Rahul Kumar Singh wrote: > So how to disa

Re: SSL / TLS compression | SPDY service|CVE-2012-4929

2015-03-27 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Ognjen, On 3/27/15 11:04 AM, Ognjen Blagojevic wrote: > On 27.3.2015 14:42, Rahul Kumar Singh wrote: >> So how to disable compression and / or the SPDY service in >> tomcat6. > > If you are using JSSE connectors (BIO/NIO/NIO2), compression is > alr

Re: SSL / TLS compression | SPDY service|CVE-2012-4929

2015-03-27 Thread Ognjen Blagojevic
Rahul, On 27.3.2015 14:42, Rahul Kumar Singh wrote: So how to disable compression and / or the SPDY service in tomcat6. If you are using JSSE connectors (BIO/NIO/NIO2), compression is already disabled because JSSE does not support it, and there is no support for SPDY protocol on those connec

SSL / TLS compression | SPDY service|CVE-2012-4929

2015-03-27 Thread Rahul Kumar Singh
Hello Tomcat support team, Thanks for your continuous support. Problem : Security issue | CVE-2012-4929 Overview: The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without properly obfuscating the length of the une