Re: Truly scary SSL 3.0 vuln to be revealed soon:

[Daniel Kahn Gillmor <dkg () fifthhorseman net>]

On 10/16/2014 12:42 PM, Sona Sarmadi wrote:
> > Hanno Böck wrote:
> > > It's out:
> > >
> > > https://www.openssl.org/~bodo/ssl-poodle.pdf
> > > http://googleonlinesecurity.blogspot.de/2014/10/this-poodle-bites-
> > exploiting-ssl-30.html
>
> OpenSSL has patches for this and 3 other vulnerabilities: 
>
>    https://www.openssl.org/news/secadv_20141015.txt
>
> GnuTLS also implements the SSLv3 protocol, does anyone know if there are any  patches for GnuTLS for the SSL 3.0 
> protocol vulnerability? 

Please see: http://www.gnutls.org/security.html#GNUTLS-SA-2014-4

and Nikos' writeup here:

 http://nmav.gnutls.org/2014/10/what-about-poodle.html

From the latter link:

> > > The good news is, that only browsers use this construct, and no
> > > other applications should be affected.

Nikos (or anyone else on OSS-security), are you sure that only browsers
do this?  what about mail clients like Thunderbird or Mail.app making
IMAPS or POPS or submission connections?

        --dkg

Attachment: signature.asc
Description: OpenPGP digital signature