Bug 36171

Summary:	nss: SSL3 protocol attack (3.2)
Product:	UCS	Reporter:	Moritz Muehlenhoff <jmm>
Component:	Security updates	Assignee:	Security maintainers <security-maintainers>
Status:	CLOSED WORKSFORME	QA Contact:
Severity:	normal
Priority:	P5	CC:	gohmann
Version:	UCS 3.2
Target Milestone:	UCS 3.2-x-errata
Hardware:	Other
OS:	Linux
What kind of report is it?:	---	What type of bug is this?:	---
Who will be affected by this bug?:	---	How will those affected feel about the bug?:	---
User Pain:		Enterprise Customer affected?:
School Customer affected?:		ISV affected?:
Waiting Support:		Flags outvoted (downgraded) after PO Review:
Ticket number:		Bug group (optional):
Max CVSS v3 score:

Description Moritz Muehlenhoff

2014-10-15 10:40:03 CEST

+++ This bug was initially created as a clone of Bug #36170 +++

CVE-2014-3566

This will requires fixes in openssl, gnutls and nss. Firefox also needs a fix since it uses a local nss copy. (There are additional Firefox issues, so I'll file a separate bug).

http://googleonlinesecurity.blogspot.fr/2014/10/this-poodle-bites-exploiting-ssl-30.html
https://www.openssl.org/~bodo/ssl-poodle.pdf

Comment 1 Moritz Muehlenhoff

2014-10-30 13:02:12 CET

An implementation of SCSV isn't available yet, resetting target milestone

Comment 2 Moritz Muehlenhoff

2014-12-09 15:12:32 CET

NSS upstream won't change it; as long as a client like uses a secure protocol version like TLS 1.x, setups are secure.