Details
-
Bug
-
Status: Resolved
-
Minor
-
Resolution: Fixed
-
1.5.10, 1.6.3, 1.7.3, 1.8.0, 1.8.1
-
None
Description
SSLModule configures the SSLContext when using "untrusted" configuration:
sc = SSLContext.getInstance("SSL"); sc.init(null, new TrustManager[] { trustAllCerts }, new SecureRandom());
This makes the client end of the SSL connection vulnerable to POODLE (http://googleonlinesecurity.blogspot.com/2014/10/this-poodle-bites-exploiting-ssl-30.html)
jclouds should consider enforcing TLS on all client connections, even on ones already susceptible to MITM attacks.
We should also investigate other uses of SSLContext in jclouds.
Attachments
Attachments
1.
|
Make it easier to configure TLS overrides in apache hc driver | Open | Unassigned |