Are Apache Tomcat servers using Tomcat Native & APR vulnerable to the HeartBleed OpenSSL bug, or does this layer insulate them? http://tomcat.apache.org/native-doc/
HeartBleed OpenSSL bug information: http://heartbleed.com/
On my Apache Tomcat server, I have:
- A vulnerable version of OpenSSL
- Built and installed APR
- Built and installed Tomcat Native using --with-apr and --with-ssl
- Tomcat is handling requests directly. A Connector on port 443 is configured with attributes SSLEnabled, SSLProtocol, SSLCipherSuite, SSLCertificateFile, SSLCertificateKeyFile, SSLCertificateChainFile
- SSLProtocol="-ALL +SSLv3 +TLSv1"
- Do versions of Tomcat, APR, or Tomcat Native have any affect on vulnerability?
- Do SSLProtocol or SSLCipherSuite values affect vulnerability?