Workaround for JSSE getPeerHost issue in OpenSAML 2.6.x? (Oracle's CVE-2015-2625 "fix")

[Cantor, Scott]

On 9/7/15, 10:27 AM, "dev on behalf of Kaspar Brand" <dev-bounces at shibboleth.net on behalf of kaspar.brand at switch.ch> wrote:

>In the dev call notes from 7 August, there's an item about "a v2 bugfix
>release for soon-ish the JSSE getPeerHost() issue."
>
>Under the assumption that the JDK-8132662 bug [1] is unlikely to be
>addressed in the near future, I was wondering about the plans for
>working around this in OpenSAML 2.6.x (or the IdP 2.4.5, more specifically)?

Brent's on vacation for another couple of weeks, so any answer on timing will have to wait for him to get back, because it's his baby now. I don't even know if it can be worked around in every case.

I'm not as willing to just give Oracle a pass here. It's their bug and they need to fix it.

>I would consider the "-Djdk.tls.trustNameService=true" JVM setting a
>short-term workaround only - i.e. not something we would want to
>recommend for deployments in our federation as a permanent solution
>(as Oracle's release notes [2] state: "Note that if the name service is
>not trustworthy, enabling reverse name lookup may be susceptible to MITM
>attacks.").

I don't think that's relevant to the IdP. That applies if you're actually doing name checks against IP addresses with certs containing hostnames. A basic warning not to do that could be attached to any documentation on it.

-- Scott