Liferay Portal CE 7.0 and Liferay DXP 7.0 and above require Java 8, so these deployments have TLS 1.2 enabled by default and ensure that outbound connections can use higher secure protocol versions. There is another Java system property available called https.protocols, which controls the protocol version used by Java clients in certain cases (see details on Oracle's blog: Diagnosing TLS, SSL, and HTTPS).Īs a result of these, Liferay Portal CE and DXP deployments are affected differently. As of Java 6u111, TLS 1.1 is also supported, though this update is available for Oracle Subscribers only. On Java 6, the default and only client-side TLS version is TLS 1.0. The system property,, is available as of Java 7u95 (for Oracle Subscribers only). As of Java 7u111, TLS 1.2 is also enabled by default, though this update is available for Oracle Subscribers only. On Java 7, the default client-side TLS version is TLS 1.0, but TLS 1.1 and 1.2 are also supported, though must be enabled manually. Java 8 also introduced a new system property called to configure which protocols are enabled. On Java 8, the default client-side TLS version is TLS 1.2 (TLS 1.1 is also supported and enabled). Mitigation Notes for Deployments Technical Information Server administrators should review their deployment configurations and adjust them (if needed) to enable initiating secure connections using a higher TLS protocol version and to prevent falling back to TLS 1.0. There are Liferay Portal CE/EE and Liferay DXP functionalities and applications that make outbound connections to remote servers (including Liferay services and websites). Liferay Portal CE and Liferay DXP Functionality What TLS version Liferay systems are going to support Moving to TLS 1.1 and higher will allow users to keep communications between Liferay and secure. Due to these security risks, Liferay decided to disable TLS 1.0, as many other companies have done. The vulnerabilities in TLS 1.0 (and SSL protocols) include POODLE and DROWN. Update: This has been moved to January 11, 2019.
0 kommentar(er)
