HostName verification not performed during SSL handshake, SAP security note 1381198

SAP security note 1381198, “HostName verification not performed during SSL handshake”. Below are the symptom and SAP recommended solution.

Description

Symptom

Hostname verification of the server certificate does not occur during the SSL Handshake.

Solution

To enable hostname verification, configure the following SOAP Adapter module parameter in the receiver SOAP adapter channel:

• Module Name: sap.com/com.sap.aii.af.soapadapter/XISOAPAdapterBean
• Parameter Name: hostVerification
• Parameter Value: true

This issue has been addressed through code changes. To apply the solution, update the relevant software components to the patch levels specified in the “SP Patch Level” section of this note or upgrade to newer versions as recommended.

For detailed instructions and to download the necessary patches, visit the SAP Service Marketplace.

Reason and prerequisites

The Process Integration Adapter Framework utilizes security libraries for the SSL Handshake. By default, hostname verification is set to false in these libraries. As a result, while the SSL Handshake may complete successfully, the hostname verification does not take place, potentially allowing connections to malicious servers. This omission poses a significant security threat. To mitigate this, the PI AFW security code has been enhanced to perform hostname verification during the SSL Handshake.

References

• XI 30 Support Package Stack (SPS) 28
• SAP EhP2 for Netweaver 7.00 SP07
• SAP EhP1 for XI on Netweaver 7.00 SP08
• NW04s XI Support Package Stack 23
• SAP EHP1 FOR SAP NETWEAVER PI 7.1 SP05