8

Please provide the fix for How do I patch/workaround SSLv3 POODLE vulnerability (CVE­-2014­-3566)? for Tomcat.

I have tried following below link, however it does not help: tomcat-users mailing list archives

  • 1
    Note that the real answer here will depend on the version of Tomcat: Tomcat 6 & Tomcat 7 have different configuration directives; and Tomcat 6 added some specific SSL directives somewhere around 6.0.32. The configuration directives depend on if you are using JSSE verses APR/Native connectors. The supported of TLS specified in the parameters will depend on your Java version. – Stefan Lasiewski Oct 16 '14 at 17:22
  • Also see ServerFault: serverfault.com/questions/637649/… – Stefan Lasiewski Oct 22 '14 at 17:52
7

Add the below string to server.xml connecter

sslEnabledProtocols="TLSv1, TLSv1.1, TLSv1.2"

and then remove

sslProtocols="TLS"

check on

http://poodlebleed.com/
https://www.ssllabs.com/ssltest/

  • This isn't working for us with Tomcat6. – Stefan Lasiewski Oct 15 '14 at 22:46
  • These are Tomcat 7 instructions. For 6, go to this page and search for "TLS": tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html or check out Marco Polo's answer below. – GlenPeterson Oct 15 '14 at 23:21
  • 1
    Hmm, that Tomcat 6 doc says it supports sslEnabledProtocols and there is no mention on that page of sslProtocols. Is that an inaccuracy in the Tomcat docs or is it JVM dependent? – Bradley Oct 16 '14 at 12:44
  • @Bradley Tomcat 6 changed these directives somewhere after Tomcat 6.0.36. See our answer on ServerFault at serverfault.com/a/637666/36178 – Stefan Lasiewski Oct 22 '14 at 17:51
2

Using

sslEnabledProtocols="TLSv1, TLSv1.1, TLSv1.2" 

did not work for us. We had to use

sslProtocols="TLSv1, TLSv1.1, TLSv1.2"

and left out the sslEnabledProtocols altogether.

  • What version of Tomcat? – GlenPeterson Oct 15 '14 at 23:22
  • Tested and confirmed on tomcat 6. – RobinCominotto Oct 16 '14 at 15:05
  • Is that a typo? Did you mean sslProtocol (singular) instead of sslProtocols (plural)? The Tomcat docs say sslProtocol, not sslProtocols. – Stefan Lasiewski Oct 16 '14 at 17:04
  • Well, sslProtocols works for me as well on Tomcat 6. I find it strange that the documentation only mentions sslProtocol (no s). – Stefan Lasiewski Oct 16 '14 at 22:07
2

All more modern browsers of note work with at least TLS1. There are no safe SSL protocols any more, which means no more IE6 access to secure web sites.

Test your server for this vulnerability with nmap in a few seconds:

nmap --script ssl-cert,ssl-enum-ciphers -p 443 www.example.com

If ssl-enum-ciphers lists a "SSLv3:" section or any other SSL sections, your server is vulnerable.

To patch this vulnerability on a Tomcat 7 web server, in the server.xml connector, remove

sslProtocols="TLS"

(or sslProtocol="SSL" or similar) and replace it with:

sslEnabledProtocols="TLSv1, TLSv1.1, TLSv1.2"

Then restart tomcat and test again to verify that SSL is no longer accepted. Thanks to Connor Relleen for the correct sslEnabledProtocols string.

0

For Tomcat 6, in addition to the above, we also had to do the following:

In server.xml connector, add:

ciphers="TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA"

Source: https://forums.openclinica.com/discussion/15696/firefox-39-new-ssl-cipher-security-setting-error-tomcat-6-fix

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.