Jira vulnerable to CVE-2011-1473 (DoS via repeated SSL session renegotiations)

Leif Neve

Jira allows SSL renegotiation as shown in the following test. Feel free to try it:

% openssl s_client -connect lhce-jira.nlm.nih.gov:8443

...stuff deleted...

R

RENEGOTIATING

...after a request to renegotiate the connection, Jira maintains the connection instead of exiting with a handshake failure...

How can we configure Jira to not allow SSL renegotiation?

Leif Neve

I ended up using Apache as a reverse proxy following instructions here and Jira is no longer vulnerable:

https://confluence.atlassian.com/display/JIRA/Integrating+JIRA+with+Apache+using+SSL