Search code examples
java-8openssltls1.2jboss-eap-7

Vulnerability in Redhat Jboss Server (sweet 32) birthday attack


I have an issue, regarding the Sweet32 attack, It says to configure the security using Highly secured ciphers. But when i look into the browser, it says "The connection to this site is encrypted and authenticated using TLS 1.2 (a strong protocol), ECDHE_RSA with P-256 (a strong key exchange), and AES_128_GCM (a strong cipher)." I'm not sure why this is still throwing a flaw with CVE-2016-2183. In the port 8443 there is a jbpm dash-builder is up running.


Solution

  • The browser shows what protocol it is using. That may not be the only protocol supported by the web/app servers.

    What web server are you using? What library do you use for SSL/TLS connections there? Typically, most of them use OpenSSL. I think you already have the latest (or something close to it), since the browser can make connections to it.

    What version of Java are you using? The JRE used by your application server, should have the weaker algorithms disabled.

    Most of the JREs allow you to disable the weaker algorithms by editing the java.security file:

    jdk.tls.disabledAlgorithms=SSLv3,DESede,DES
    

    Along with this, make sure your web server supports only the latest ciphers.