8

Please provide the fix for How do I patch/workaround SSLv3 POODLE vulnerability (CVE­-2014­-3566)? for Tomcat.

I have tried following below link, however it does not help: tomcat-users mailing list archives

2
  • 1
    Note that the real answer here will depend on the version of Tomcat: Tomcat 6 & Tomcat 7 have different configuration directives; and Tomcat 6 added some specific SSL directives somewhere around 6.0.32. The configuration directives depend on if you are using JSSE verses APR/Native connectors. The supported of TLS specified in the parameters will depend on your Java version. Oct 16, 2014 at 17:22
  • Also see ServerFault: serverfault.com/questions/637649/… Oct 22, 2014 at 17:52

4 Answers 4

7

Add the below string to server.xml connecter

sslEnabledProtocols="TLSv1, TLSv1.1, TLSv1.2"

and then remove

sslProtocols="TLS"

check on

http://poodlebleed.com/
https://www.ssllabs.com/ssltest/

4
  • This isn't working for us with Tomcat6. Oct 15, 2014 at 22:46
  • These are Tomcat 7 instructions. For 6, go to this page and search for "TLS": tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html or check out Marco Polo's answer below. Oct 15, 2014 at 23:21
  • 1
    Hmm, that Tomcat 6 doc says it supports sslEnabledProtocols and there is no mention on that page of sslProtocols. Is that an inaccuracy in the Tomcat docs or is it JVM dependent?
    – Bradley
    Oct 16, 2014 at 12:44
  • @Bradley Tomcat 6 changed these directives somewhere after Tomcat 6.0.36. See our answer on ServerFault at serverfault.com/a/637666/36178 Oct 22, 2014 at 17:51
2

Using

sslEnabledProtocols="TLSv1, TLSv1.1, TLSv1.2" 

did not work for us. We had to use

sslProtocols="TLSv1, TLSv1.1, TLSv1.2"

and left out the sslEnabledProtocols altogether.

4
  • What version of Tomcat? Oct 15, 2014 at 23:22
  • Tested and confirmed on tomcat 6. Oct 16, 2014 at 15:05
  • Is that a typo? Did you mean sslProtocol (singular) instead of sslProtocols (plural)? The Tomcat docs say sslProtocol, not sslProtocols. Oct 16, 2014 at 17:04
  • Well, sslProtocols works for me as well on Tomcat 6. I find it strange that the documentation only mentions sslProtocol (no s). Oct 16, 2014 at 22:07
2

All more modern browsers of note work with at least TLS1. There are no safe SSL protocols any more, which means no more IE6 access to secure web sites.

Test your server for this vulnerability with nmap in a few seconds:

nmap --script ssl-cert,ssl-enum-ciphers -p 443 www.example.com

If ssl-enum-ciphers lists a "SSLv3:" section or any other SSL sections, your server is vulnerable.

To patch this vulnerability on a Tomcat 7 web server, in the server.xml connector, remove

sslProtocols="TLS"

(or sslProtocol="SSL" or similar) and replace it with:

sslEnabledProtocols="TLSv1, TLSv1.1, TLSv1.2"

Then restart tomcat and test again to verify that SSL is no longer accepted. Thanks to Connor Relleen for the correct sslEnabledProtocols string.

0

For Tomcat 6, in addition to the above, we also had to do the following:

In server.xml connector, add:

ciphers="TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA"

Source: https://forums.openclinica.com/discussion/15696/firefox-39-new-ssl-cipher-security-setting-error-tomcat-6-fix

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .