Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM Operational Decision Manager (CVE-2015-4000)

Workarounds and Mitigations

There is NO mitigation if any of the EXPORT ciphers have been enabled. EXPORT cipher suites are vulnerable to the FREAK and LOGJAM vulnerabilities with NO mitigation possible. Do NOT enable these ciphers without complete understanding of the environment.

For all others, consider implementing one of the mitigation methods described below.

Java 5 and Java 6 Mitigation:

1. Not explicit enabling the DH or DHE cipher suite(s) via setEnabledCipherSuites() method

2. For HttpsURLConnection, set https.cipherSuites system property to not include DH or DHE cipher suites.

3. Configure SP800-131a strict compliance or any Suite B configuration

NOTE: For those which use JVM defaults or the default list of ciphers provided by the JVM there is NO Mitigation, you need to apply the upcoming iFix which will enforce a minimum 768 bit prime size for DH and DHE cipher suites and resolve the problem.

Java 7 and Java 8 Mitigation:

1. Disabling DH and DHE cipher suites. The can be achieved by adding the DH and DHE cipher suites to the list of disabled algorithms defined by the jdk.tls.disabledAlgorithms security property in java.security (jre/lib/security/java.security) file, e.g.,

jdk.tls.disabledAlgorithms=SSLv3, RC4, DH, DHE

2. Not explicit enabling the DH or DHE cipher suite(s) via setEnabledCipherSuites() method.

3. For HttpsURLConnection, set https.cipherSuites system property to not include DH or DHE cipher suites.

4. Configure SP800-131a strict compliance or any Suite B configuration

NOTE: For those which use JVM defaults or the default list of ciphers provided by the JVM there is NO Mitigation, you need to apply the upcoming iFix which will enforce a minimum 768 bit prime size for DH and DHE cipher suites and resolve the problem.