Jira vulnerable to CVE-2011-1473 (DoS via repeated SSL session renegotiations)

Jira allows SSL renegotiation as shown in the following test. Feel free to try it:

% openssl s_client -connect lhce-jira.nlm.nih.gov:8443

...stuff deleted...

RENEGOTIATING

...after a request to renegotiate the connection, Jira maintains the connection instead of exiting with a handshake failure...

How can we configure Jira to not allow SSL renegotiation?

1 answer

Community moderators have prevented the ability to post new answers.

0 votes

Answer accepted

I ended up using Apache as a reverse proxy following instructions here and Jira is no longer vulnerable:

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.