0002081: Disable SSLv3

JumpMind · Nov 24, 2014 · 68f4a95 · 68f4a95
1 parent 0a0d682
commit 68f4a95
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/symmetric-server/src/main/java/org/jumpmind/symmetric/SymmetricWebServer.java b/symmetric-server/src/main/java/org/jumpmind/symmetric/SymmetricWebServer.java
@@ -379,6 +379,8 @@ protected Connector[] getConnectors(int port, int securePort, Mode mode) {
             SslContextFactory sslConnectorFactory = ((SslSocketConnector) connector).getSslContextFactory();
             sslConnectorFactory.setKeyStorePath(keyStoreFile);
             sslConnectorFactory.setKeyManagerPassword(keyStorePassword);
+            /* Prevent POODLE attack */
+            sslConnectorFactory.addExcludeProtocols("SSLv3");
             sslConnectorFactory.setCertAlias(System.getProperty(SystemConstants.SYSPROP_KEYSTORE_CERT_ALIAS, SecurityConstants.ALIAS_SYM_PRIVATE_KEY));
             sslConnectorFactory.setKeyStoreType(keyStoreType);