TLS Client-initiated renegotiation attack (CVE-2011-1473)

[ghost]

4.2.0 and 4.3.0 is in use. when do the security scan, CVE-2011-1473 related issue is reported for the port 9876(nameserver) and 10911(broker).

is any version/release with this issued sovled?

[duhenglucky]

@bix29 it seems that it's a openssl issue, could you pull a request to resolve this problem? and it seems that only OpenSSL 1.0.2 or previous version has this problem.

[Journey-x]

My Server OpenSSL version is 1.1.1d and CVE-2011-1473 still has this problem.

[ShadowySpirits]

@bix29 it seems that it's a openssl issue, could you pull a request to resolve this problem? and it seems that only OpenSSL 1.0.2 or previous version has this problem.

IMO, this issue is caused by SslProvider being always JDK instead of the Provider selected in upper code by default

TlsHelper.java：

            if (tlsTestModeEnable) {  // default is true
                SelfSignedCertificate selfSignedCertificate = new SelfSignedCertificate();
                return SslContextBuilder
                    .forServer(selfSignedCertificate.certificate(), selfSignedCertificate.privateKey())
                    .sslProvider(SslProvider.JDK)   // always use jdk ssl
                    .clientAuth(ClientAuth.OPTIONAL)
                    .build();
            } else { ...