Re: [VOTE] Release Apache Tomcat 6.0.43

2014-11-21 Thread Andrew Carr
Chris, Thanks for the response. I didn't understand the "nope" at the bottom. Was it in reference to the Java 8 documentation or the screenshot? If it was the screenshot, it is attached to my email, but maybe the mailing list removed it? http://snag.gy/lcyLt.jpg -Andrew On Thu, Nov 20, 2014 a

Re: [VOTE] Release Apache Tomcat 6.0.43

2014-11-20 Thread Christopher Schultz
Andrew, On 11/19/14 2:47 AM, Andrew Carr wrote: > If you review the Tomcat 6 documentation > here: https://tomcat.apache.org/tomcat-6.0-doc/config/http.html#SSL_Support > , you will see "sslEnabledProtocols." On the desc. for that setting > there are links for Java 6 and Java 7 protocol lists,

Re: [VOTE] Release Apache Tomcat 6.0.43

2014-11-18 Thread Andrew Carr
If you review the Tomcat 6 documentation here: https://tomcat.apache.org/tomcat-6.0-doc/config/http.html#SSL_Support , you will see "sslEnabledProtocols." On the desc. for that setting there are links for Java 6 and Java 7 protocol lists, and they both include SSLv2. Not nitpicking here, just k

Re: [VOTE] Release Apache Tomcat 6.0.43

2014-11-18 Thread Christopher Schultz
Andrew, On 11/18/14 2:58 PM, Andrew Carr wrote: > Chris, > > Thank you for the response. I will include the full stack trace next time. > >> >> >> >> Note that, like polio, SSLv2 has been wiped from the face of the planet. >> >> This is not an error. This will not impact anyone of consequence. >

Re: [VOTE] Release Apache Tomcat 6.0.43

2014-11-18 Thread Andrew Carr
Thanks Konstantin On Tue, Nov 18, 2014 at 3:09 PM, Konstantin Kolinko wrote: > 2014-11-17 22:26 GMT+03:00 Andrew Carr : > > +1 stable << for me > > > > However, and I don't know if this is a game changer, I am having a > problem > > when implementing SSL using the NIOConnector, althought the pro

Re: [VOTE] Release Apache Tomcat 6.0.43

2014-11-18 Thread Konstantin Kolinko
2014-11-17 22:26 GMT+03:00 Andrew Carr : > +1 stable << for me > > However, and I don't know if this is a game changer, I am having a problem > when implementing SSL using the NIOConnector, althought the problem does > not look like a Tomcat source problem. I did verify that disabling SSLv3 > doe

Re: [VOTE] Release Apache Tomcat 6.0.43

2014-11-18 Thread Andrew Carr
Chris, Thank you for the response. I will include the full stack trace next time. > > > > Note that, like polio, SSLv2 has been wiped from the face of the planet. > > This is not an error. This will not impact anyone of consequence. > > You may be looking for "SSLv2Hello". > > -chirs > > > > You

Re: [VOTE] Release Apache Tomcat 6.0.43

2014-11-18 Thread Christopher Schultz
Andrew, On 11/17/14 2:26 PM, Andrew Carr wrote: > +1 stable << for me > > However, and I don't know if this is a game changer, I am having a problem > when implementing SSL using the NIOConnector, althought the problem does > not look like a Tomcat source problem. I did verify that disabling SS

Re: [VOTE] Release Apache Tomcat 6.0.43

2014-11-18 Thread jean-frederic clere
On 11/14/2014 11:42 AM, Mark Thomas wrote: [X] Stable - go ahead and release as 6.0.43 Stable My tests are passing. Cheers Jean-Frederic - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e

Re: [VOTE] Release Apache Tomcat 6.0.43

2014-11-17 Thread Andrew Carr
Team, I can see this "SSlv2" setting impacting the Tomcat community. If someone explicity sets SSLv2 in the sslEnabledProtocols setting their Tomcat SSL connector will not work properly. The error does not occur on *startup*, but occurs when a user tries to access the SSL connector. -Andrew O

Re: [VOTE] Release Apache Tomcat 6.0.43

2014-11-17 Thread Andrew Carr
+1 stable << for me However, and I don't know if this is a game changer, I am having a problem when implementing SSL using the NIOConnector, althought the problem does not look like a Tomcat source problem. I did verify that disabling SSLv3 does indeed prevent a client from connecting to the ser

Re: [VOTE] Release Apache Tomcat 6.0.43

2014-11-17 Thread Violeta Georgieva
+1 stable Regards, Violeta На петък, 14 ноември 2014 г. Mark Thomas написа: > The proposed Apache Tomcat 6.0.43 release is now available for voting. > > The key changes since 6.0.41 are: > > - Disable SSLv3 by default in light of the recently announced POODLE > vulnerability. (CVE-2014-3566)

Re: [VOTE] Release Apache Tomcat 6.0.43

2014-11-16 Thread Konstantin Kolinko
2014-11-14 13:42 GMT+03:00 Mark Thomas : > The proposed Apache Tomcat 6.0.43 release is now available for voting. > > The key changes since 6.0.41 are: > > - Disable SSLv3 by default in light of the recently announced POODLE > vulnerability. (CVE-2014-3566) > > - Update to Tomcat Native Library v

Re: [VOTE] Release Apache Tomcat 6.0.43

2014-11-14 Thread Mark Thomas
On 14/11/2014 10:42, Mark Thomas wrote: > The proposed Apache Tomcat 6.0.43 release is now available for voting. > > The key changes since 6.0.41 are: > > - Disable SSLv3 by default in light of the recently announced POODLE > vulnerability. (CVE-2014-3566) > > - Update to Tomcat Native Library