Closed
Description
Line 50 of com/github/dockerjava/core/LocalDirectorySSLConfig.java
does this:
System.setProperty("https.protocols", "TLSv1");
This is exactly as horrible as it looks - it forces everything else in this VM down to TLSv1.0. This silently degrates TLS security, and/or loudly causes requests (to TLS-v1.1+-only endpoints) to fail.
If (and only if) https.protocols
has been explicitly set to something non-default, this code restores the original values after creating an SslConfigurator
. But even this is not acceptable in any multi-threaded application, as it creates a race condition that affects any TLS requests during this time.
Metadata
Metadata
Assignees
Labels
No labels