Uploaded image for project: 'Bitrepository'
  1. Bitrepository
  2. BITMAG-1130

Bitrepository overrides SSL context unconditionally

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • Major
    • 1.9
    • None
    • Security
    • None

    Description

      When loading certificates from client private key, and certificates from RepositorySettings, the reference code creates an entire new SSL context and sets that as the default one. This overrides any SSL context that may have come from somewhere else in the JVM.

      This behavior is not a problem as long as the bitrepository code is running in its own JVM, but when using the referencecode libraries in another product and thereby sharing the JVM it causes problems with the SSL context.

      The fix should be that the reference code extends the SSL context if one exists.
      This should not affect the security model, as permission handling is done separately from certificate storage.

      Attachments

        Activity

          People

            Unassigned Unassigned
            ktc Kim Christensen (Inactive)
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Time Tracking

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - Not Specified
                Not Specified
                Logged:
                Time Spent - 0.15h
                0.15h