Workaround for JSSE getPeerHost issue in OpenSAML 2.6.x? (Oracle's CVE-2015-2625 "fix")

[Kaspar Brand]

In the dev call notes from 7 August, there's an item about "a v2 bugfix
release for soon-ish the JSSE getPeerHost() issue."

Under the assumption that the JDK-8132662 bug [1] is unlikely to be
addressed in the near future, I was wondering about the plans for
working around this in OpenSAML 2.6.x (or the IdP 2.4.5, more specifically)?

I would consider the "-Djdk.tls.trustNameService=true" JVM setting a
short-term workaround only - i.e. not something we would want to
recommend for deployments in our federation as a permanent solution
(as Oracle's release notes [2] state: "Note that if the name service is
not trustworthy, enabling reverse name lookup may be susceptible to MITM
attacks.").

Kaspar


[1] http://bugs.java.com/bugdatabase/view_bug.do?bug_id=8132662

[2] http://www.oracle.com/technetwork/java/javase/8u51-relnotes-2587590.html