Re: POODLE vulnerability
Zhong Shi Lu <[email protected]> Wed, 12 Nov 2014 09:32:35 +0800
| Newsgroups | gmane.network.open-pegasus.general |
|---|---|
| Message-ID | <OF6D727843.661BF970-ON48257D8E.00084930-48257D8E.000895B1@cn.ibm.com> |
--0__=C7BBF71DDF9BCFA08f9e8a93df938690918cC7BBF71DDF9BCFA0 Content-type: multipart/alternative; Boundary="1__=C7BBF71DDF9BCFA08f9e8a93df938690918cC7BBF71DDF9BCFA0" --1__=C7BBF71DDF9BCFA08f9e8a93df938690918cC7BBF71DDF9BCFA0 Content-type: text/plain; charset=US-ASCII Content-transfer-encoding: quoted-printable Yes, I think Pegasus has been impacted by "Poodle". It is possible to disable SSLv3 protocol when making SSLContext in _makeSSLContext(). Regards, Zack Lu From: "Singh, Devendra \(UPEL\)" <[email protected]> To: "[email protected]" <[email protected]> Date: 11/11/2014 02:16 PM Subject: POODLE vulnerability Is Open Pegasus impacted due to POODLE vulnerability? Since cimserver c= an accept connections using SSLV3 and SSLV3 is still not disabled on serve= r side so I think its vulnerable. Currently we are using 2.11 version of OP. Please share your thoughts o= n this. Regards, Devendra = --1__=C7BBF71DDF9BCFA08f9e8a93df938690918cC7BBF71DDF9BCFA0 Content-type: text/html; charset=US-ASCII Content-Disposition: inline Content-transfer-encoding: quoted-printable <html><body> <p><font size=3D"2" face=3D"sans-serif">Yes, I think Pegasus has been i= mpacted by "Poodle".</font><br> <font size=3D"2" face=3D"sans-serif">It is possible to disable SSLv3 pr= otocol when making SSLContext in _makeSSLContext().</font><br> <br> <font size=3D"2" face=3D"sans-serif">Regards,</font><br> <font size=3D"2" face=3D"sans-serif">Zack Lu</font><br> <br> <img width=3D"16" height=3D"16" src=3D"cid:1__=3DC7BBF71DDF9BCFA08f9e8a= [email protected]" border=3D"0" alt=3D"Inactive hide details for "= ;Singh, Devendra \(UPEL\)" ---11/11/2014 02:16:41 PM---Is Open Peg= asus impacted due to POODLE vulnera"><font size=3D"2" color=3D"#424282"= face=3D"sans-serif">"Singh, Devendra \(UPEL\)" ---11/11/2014= 02:16:41 PM---Is Open Pegasus impacted due to POODLE vulnerability? Si= nce cimserver can accept connections using S</font><br> <br> <font size=3D"1" color=3D"#5F5F5F" face=3D"sans-serif">From: </font><fo= nt size=3D"1" face=3D"sans-serif">"Singh, Devendra \(UPEL\)" = <[email protected]></font><br> <font size=3D"1" color=3D"#5F5F5F" face=3D"sans-serif">To: </font><font= size=3D"1" face=3D"sans-serif">"[email protected]" <= ;[email protected]></font><br> <font size=3D"1" color=3D"#5F5F5F" face=3D"sans-serif">Date: </font><fo= nt size=3D"1" face=3D"sans-serif">11/11/2014 02:16 PM</font><br> <font size=3D"1" color=3D"#5F5F5F" face=3D"sans-serif">Subject: </font>= <font size=3D"1" face=3D"sans-serif">POODLE vulnerability</font><br> <hr width=3D"100%" size=3D"2" align=3D"left" noshade style=3D"color:#80= 91A5; "><br> <br> <br> <font size=3D"3" face=3D"Times New Roman">Is Open Pegasus impacted due = to POODLE vulnerability? Since cimserver can accept connections using S= SLV3 and SSLV3 is still not disabled on server side so I think its vuln= erable. <br> Currently we are using 2.11 version of OP. Please share your thoughts o= n this.</font> <p><font size=3D"3" face=3D"Times New Roman">Regards,<br> Devendra</font><br> <font size=3D"2" face=3D"Calibri"> </font><br> </body></html>= --1__=C7BBF71DDF9BCFA08f9e8a93df938690918cC7BBF71DDF9BCFA0-- --0__=C7BBF71DDF9BCFA08f9e8a93df938690918cC7BBF71DDF9BCFA0 Content-type: image/gif; name="graycol.gif" Content-Disposition: inline; filename="graycol.gif" Content-ID: <[email protected]> Content-transfer-encoding: base64 R0lGODlhEAAQAKECAMzMzAAAAP///wAAACH5BAEAAAIALAAAAAAQABAAAAIXlI+py+0PopwxUbpu ZRfKZ2zgSJbmSRYAIf4fT3B0aW1pemVkIGJ5IFVsZWFkIFNtYXJ0U2F2ZXIhAAA7 --0__=C7BBF71DDF9BCFA08f9e8a93df938690918cC7BBF71DDF9BCFA0--