SSL 3.0 (poodle) vulnerability?

Viren Patel
16 October 2014, 19:16

Hiawatha version: 9.8
Operating System: CentOS 5

Is Hiawatha 9.8 vulnerable to SSL 3.0 (Poodle) bug? Several tests (designed for Apache) return true on my websites. If so how to disable SSL 3.0? Thanks.
Hugo Leisink
16 October 2014, 19:18
No, SSL3.0 is disabled by default. Hiawatha is only vulnerable for this if you've explicitly enabled SSL3.0 via MinSSLversion = SSL3.0.
16 October 2014, 19:30
Thanks! Good to know! Is there a Hiawatha specific test to verify? My superiors will ask for this.
Hugo Leisink
16 October 2014, 19:59
David Oliver
16 October 2014, 23:26
Which version of Hiawatha disabled SSL3.0 by default? (I'm going to create new VPSes soon, anyway.)

SSL Labs tells me:

This server uses SSL 3, with POODLE mitigated. Still, it's recommended that this protocol is disabled.
David Oliver
16 October 2014, 23:33
Sorry - never mind. I've just realised that 'MinSSLversion' is a main config file setting anyway, so I can update it easily enough.
Hugo Leisink
17 October 2014, 00:14
Default value for MinSSLversion is set to TLS1.0 since Hiawatha v9.4. The option is available since v8.6.
This topic has been closed.