Bug 1165463

Summary: (6.3.z) HornetQ: Disallow SSLv3 [6.3.z][defense-in-depth]
Product: [JBoss] JBoss Enterprise Application Platform 6 Reporter: Arun Babu Neelicattu <aneelica>
Component: HornetQAssignee: baranowb <bbaranow>
Status: CLOSED CURRENTRELEASE QA Contact: Miroslav Novak <mnovak>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 6.3.2CC: arun.neelicattu+rhbz, bbaranow, bmaxwell, cdewolf, chaowan, csuconic, grocha, istudens, jawilson, mnovak, msvehla, rmody, twalsh, vkamble
Target Milestone: CR1Keywords: Security
Target Release: EAP 6.3.3   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-08-19 12:40:41 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1165456    
Bug Blocks: 1149127, 1151405    

Description Arun Babu Neelicattu 2014-11-19 02:27:25 UTC 
In light of POODLE, it is recommended that the use of SSLv3 be disabled as a hardening measure. This has been already done upstream via jira HORNETQ-1444. The relevant upstream commit is at [1]. We also recommend SSL support be dropped in favor of TLS protocols if feasible.

[1] https://github.com/hornetq/hornetq/commit/e9825f22568eacfb40058ce5177497cbaf2af1a0
Comment 5 Miroslav Novak 2015-01-19 13:05:17 UTC 
Verified in EAP 6.3.3.CP.CR1.
Comment 9 [DISABLED] 2015-05-11 13:17:02 UTC 
Thanks Tim :)
Comment 10 Jason Shepherd 2015-07-10 02:54:26 UTC 
*** Bug 1127075 has been marked as a duplicate of this bug. ***