[jboss-jira] [JBoss JIRA] (WFLY-3451) disabling CBC mode ciphers

[David Lloyd (JIRA)]

    [ https://issues.jboss.org/browse/WFLY-3451?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12973752#comment-12973752 ] 

David Lloyd commented on WFLY-3451:
-----------------------------------

Isn't it already possible to do this by giving !CBC in the filter string?  This would fix it for 7.x at least, and once XNIO-229 is fixed, it will be fixed in upstream as well...

> disabling CBC mode ciphers
> --------------------------
>
>                 Key: WFLY-3451
>                 URL: https://issues.jboss.org/browse/WFLY-3451
>             Project: WildFly
>          Issue Type: Sub-task
>      Security Level: Public(Everyone can see) 
>    Affects Versions: JBoss AS7 7.1.1.Final
>            Reporter: Aleksandr Voloschuk
>            Assignee: Darran Lofthouse
>            Priority: Critical
>
> encountered such a problem:
> management of information security vulnerability found on a production environment, namely:
> SSLv3.0/TLSv1.0 Protocol Weak CBC Mode Vulnerability port 8443/tcp over SSL
> RC4-SHA ECDHE-RSA-DES-CBC3-SHA SSLv3
>  they offer a solution:
> This attack was identified in 2004 and later revisions of TLS protocol which contain a fix for this. If possible, upgrade to TLSv1.1 or TLSv1.2. If
> upgrading to TLSv1.1 or TLSv1.2 is not possible, then disabling CBC mode ciphers will remove the vulnerability. Setting your SSL server to prioritize RC4 ciphers mitigates this vulnerability.
> as TLS upgrade we can not, it remains disabling CBC mode ciphers
> our platform is jboss-eap-6.1



--
This message was sent by Atlassian JIRA
(v6.2.3#6260)