4 ms·
All those TLS/SSL implementation vulnerabilities with fancy names like POODLE, for example. https://www.oracle.com/technetwork/topics/security/poodlecve-2014-3
by slrz 9y ago
All those TLS/SSL implementation vulnerabilities with fancy names like POODLE, for example.
https://www.oracle.com/technetwork/topics/security/poodlecve-2014-3566-2339408.html https://www.oracle.com/technetwork/topics/security/poodlecve...
There's a lot more but it of course depends on the subset of the JDK that you're using. Look over the release notes for historical JDK updates.
- vbezhenar 9y agoI don't use TLS and even if I would use it, I would use nginx frontend. My subset is fairy common, Spring+JDBC, sometimes Hibernate, sometimes pure servlets, but basically all interaction between outer world is via HTTP interface implemented in Tomcat.
- toyg 9y agoA targeted attack would probably hole you fairly easily then. Cleartext means you’re likely open to all sorts of replay attacks and data leaks, which can then be escalated to exploit vulnerable libs and jvm.