Tomcat – Which versions of win32 tcnative-1.dll are succeptible to heartbleed

heartbleedtomcat

We are trying to determine our window of vulnerability for Heartbleed. Does anyone have an idea of how to determine which version of OpenSSL was used to build a given Tomcat Native DLL?

Our server has had Tomcat 6 on it (not sure which version of tcnative-1.dll, but trying to track it down), upgraded to Tomcat 7 (with tcnative-1.dll version 1.1.27).

I can't find any information anywhere on which versions of tcnative-1.dll were linked against which openssl versions.

The Apache changelog doesn't have this info, and documentation provides a website that has the DLL it was linked against, but no information about which of the 17 versions it used.

Best Answer

The answer can be seen from this bugzilla entry of the apache tomcat project:

https://issues.apache.org/bugzilla/show_bug.cgi?id=56363

Affected versions are 1.1.24 until 1.1.29 (the last officially at the moment).

For the versions since 1.1.23 (which was linked against openssl 1.0.0g) you find a VERSIONS file inside of the windows binary packages you can download from the tomcat archive which give information about the libraries.

Earlier tcnative-1 versions at least contain a openssl.exe bundled which can be queried for version information with the command "version".

Related Solutions

Iis – Installing tcnative-1.dll

The official guide says:

Edit $CATALINA_BASE\bin\setenv.bat (creating the file if necessary) and add the path to the tc-native libraries, apr and OpenSSL to PATH. For example:
set PATH=%PATH;C:\cygwin\home\support\tomcat-native-current-win32-src\jni\native\Debug;C:\cygwin\home\support\tomcat-native-current-win32-src\jni\apr\Debug;C:\OpenSSL\lib\VC

And this means: add "C:\cygwin\home\support\tomcat-native-current-win32-src\jni\native\Debug" to the environment variable "PATH", so i believe that is where you should put this file.

Ssl – Verify client certificate CN in Tomcat(APR)

The above excerpt is from sever.xml file, right? I have a question, why are you not using your cacerts keystore in whichever JVM/JDK you are using? You're using this to grant https access to your application running on tomcat, right?

I'm surprised PEM format certs worked in TOMCAT. I have always had to convert PEM certs to DER format and then use it in TOMCAT.

I would suggest:

Create cert in your keystore /your/path/to/java/jre/lib/security/cacerts by using keytool binary that comes with your java installation. It is provided for you to put your java app on SSL.

if you already have your CACERT.PEM, convert it to DER using openssl:

openssl x509 -inform PEM -in CACERT.PEM -outform DER -out CACERT.DER

use keytool to import the cert into your keystore.
edit server.xml and the way you go.

Best Answer

Related Solutions

Iis – Installing tcnative-1.dll

Ssl – Verify client certificate CN in Tomcat(APR)

Related Topic