Weblog
15 October 2014, 14:40
A vulnerability has been discovered in SSL3.0 and it's called Poodle. That SSL3.0 has issues is not new, but after this discovery there is no excuse left to keep using it.
Although Hiawatha has support for SSL3.0, it is disabled by default. So, unless you have changed this behaviour via the MinSSLversion, you have nothing to worry about. In the next release, I will completely remove the support for SSL3.0. No more more leniency for WindowsXP and IE8 users.
Copyright © by Hugo Leisink. All rights reserved.
Built upon the Banshee PHP framework.
Built upon the Banshee PHP framework.
i am very happy that you will remove the SSLv3 support completly. There is an old saying. Good developers write good code, awesome developers remove legacy code!
Greetings
Leo
Everybody should avoid old XP stuff.
Thank you Hugo.
Personally, I disable SSLv3 and RC4 on all of my browsers. In Chrome, change the launch link to append the following:
On Firefox, you can enter about:config and make the following changes:
1) Set security.tls.version.min to 1
2) Search for rc4 and set each value to false
For more browser/OS combos, see here: https://zmap.io/sslv3/browsers.html [zmap.io]
To test your browser more thoroughly, see here: https://www.ssllabs.com/ssltest/viewMyClient.html [www.ssllabs.com]
https://www.poodletest.com/
Bob's Mail:
We have released LibreSSL 2.1.1- which should be arriving in the
LIbreSSL directory of an OpenBSD mirror near you very soon.
This release includes:
* Address POODLE attack by disabling SSLv3 by default
* Fix Eliptical Curve cipher selection bug
(https://github.com/libressl-portable/portable/issues/35)
As well as continued ongoing fixes as we proactively change the
codebase to reflect modern safe programming practices. The success of
this is reflected in the fact that LibreSSL was not vulnerable to the
two memory leak issues released on "OpenSSL Tuesday" - They were in
fact initially
fixed in LibreSSL.
As noted before, we welcome feedback from the broader community.
Enjoy,
-Bob
Tarball:
http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/
Of course you have todo some symlinks in Mac OSX for libssl.dylib ...
Is the goal for PolarSSL to be a drop-in replacement too? Any experiences here? Maybe with OS X?
PolarSSL is a direct replacement for OpenSSL when you look at the standards. If you look at our Features you will see similar items as on the OpenSSL feature list. The major difference is the way we make the code. We aim to help you make better applications. We provide as many documentation, examples and support as you need to be happy with the result.
PolarSSL does not yet offer an OpenSSL API. We try to make things intuitive and in most cases that means, doing it differently than the OpenSSL API. Functionally they do the same, but from a pure interface perspective, the OpenSSL API differs from the PolarSSL API in a lot of places.
From PolarSSL Website. If you dont need the OpenSSL API, than you can replace directly.
It depends on the Distris. You cant run an Ubuntu Desktop without OpenSSL API, you cant run Mac OSX. And LibreSSL or BoringSSL (I dont know it in reall life) is a choice to replace the old original OpenSSL Code. Embeded code in Hiawatha and there is an OpenVPN Version its great.
Please dont think I'm a fighter for LibreSSL, Im only happy to have a chance to replace the original OpenSSL on my systems. Please dont be mad, there was NO criticism on Hiawatha or PolarSSL. PolarSSL proteced us from Heattbleed and other issues. I really like PolarSSL.
https://polarssl.org/tech-updates/releases/polarssl-1.3.9-released
My first tests are working well with Hiawatha 9.8
apt.sparkz.no [apt.sparkz.no] should be synced shortly.