If an application does need to perform reverse name lookup for raw IP addresses in SSL/TLS connections, and encounter endpoint identification compatibility issue, System property '' can be used to switch on reverse name lookup. The risk is described by Oracle in their explanation of the change at : This reverts back to the older Java behavior while preserving all the other security related changes in the newer Java release. Option 1: Add JVM startup parameter =true Please try again later.Īt .(RiotPolice.java:113) ~Īt .(DefaultUserService.java:108) ~Ĭaused by: : Could not create DirContext instance for transaction nested exception is : :636 nested exception is : :636 Īt .(AbstractCompensatingTransactionManagerDelegate.java:90) ~Ĭaused by: : :636 nested exception is : :636 Īt .nvertLdapException(LdapUtils.java:108)Ĭaused by: : :636Īt .Connection.(Unknown Source) ~Īt .LdapClient.(Unknown Source) ~Ĭaused by: : : No subject alternative names matching IP address XXXXX foundĪt .getSSLException(Unknown Source) ~Īt .fatal(Unknown Source) ~Ĭaused by: : No subject alternative names matching IP address XXXXX foundĪt .matchIP(Unknown Source) ~

12:43:05,896 WARN XXXXX 'POST /j_stash_security_check HTTP/1.1' c.a.s.i.s.s.PluginAuthenticationProvider Could not authenticate XXXXX authentication by -authentication:crowdHttpAuthHandler failedĬom.: The remote authentication server is not available. Users will be unable to authenticate and LDAP syncs will fail. Logins and LDAP syncs should work as normal.

Upgrade the JDK to a noted Java version.

Configure a user directory using a secure LDAP connection.

Any version of Stash using one of the noted Java versions.

Secure LDAP is very common to protect passwords on the internal network, particularly in enterprise environments. This will affect any customer using secure LDAP that upgrades the JVM. īecause of this existing LDAPS connections are broken and users from that user directory are unable to login including non-local administrators. We have reported this problem to Oracle and also forwarded the information to the Java security dev list. This results in use of an IP address to make the connection and since this is no longer allowed the connection fails. The way Socket.createSocket() is used results in an SSLSocket without the hostname set in it.

We have found there is a problem with the way Java creates LDAPS connections. This change is a security feature of Java. This was a security vulnerability because an attacker that gained control of DNSĬould route traffic to their own server. Previously the JVM would do a reverse lookup of the hostname using the IP then complete the connection using that hostname. As of Java 1.8u51+ (also 1.7.0_85+ and 1.6.0_101+) making SSL connections to an IP address is no longer allowed.

I have java 51 and java 60