Univention Bugzilla – Bug 36171
nss: SSL3 protocol attack (3.2)
Last modified: 2019-04-11 19:24:04 CEST
+++ This bug was initially created as a clone of Bug #36170 +++ CVE-2014-3566 This will requires fixes in openssl, gnutls and nss. Firefox also needs a fix since it uses a local nss copy. (There are additional Firefox issues, so I'll file a separate bug). http://googleonlinesecurity.blogspot.fr/2014/10/this-poodle-bites-exploiting-ssl-30.html https://www.openssl.org/~bodo/ssl-poodle.pdf
An implementation of SCSV isn't available yet, resetting target milestone
NSS upstream won't change it; as long as a client like uses a secure protocol version like TLS 1.x, setups are secure.