Important Information about SSL V 3.0 POODLE Vulnerability

  • Sunday, 19th October, 2014
  • 11:43am
With the recent discovery of the the “Poodle” vulnerability, we’re writing today to inform you about how it may affect you, as a user of our SSL certificates.

First of all, this vulnerability does not affect SSL certificates themselves. It impacts SSL protocol functionality. There is no need to reissue and revoke your current certificates. The Poodle vulnerability affects servers running SSL 3.0. It centers on cipher block chaining (CBC) encryption implementations that can allow attackers with a Man-in-the-Middle (MITM) position to view the content of an encrypted transmission.

This is a vulnerability with the SSL protocol; existing SSL certificates are not affected and do not need to be replaced.

Please take immediate action with regard to SSL 3.0. You, your server administrator or your hosting company will need to:

1) Disable SSL 3.0 support or disable SSL 3.0 CBC-mode ciphers. You can use the corresponding SSL Toolbox to determine whether SSL 3.0 is enabled on a web server.
2) Implement the proper use of TLS_FALLBACK_SCSV, to remediate the forced downgrade issue that is part of the vulnerability.
Here are some additional resources for assistance with remediation:

« Back