Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <543E42D5.5030908@redhat.com>
Date: Wed, 15 Oct 2014 11:48:05 +0200
From: Florian Weimer <fweimer@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE assignment for POODLE

CVE-2014-3566 is currently assigned to an SSL 3.0 protocol vulnerability:

“The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other 
products, uses nondeterministic CBC padding, which makes it easier for 
man-in-the-middle attackers to obtain cleartext data via a 
padding-oracle attack, aka the "POODLE" issue.”

What we seem to be lacking is a CVE assignment for the protocol 
downgrade “dance” implemented by some browsers, explicitly designed to 
negate the effect of the downgrade protection in the TLS protocol (the 
protocol upgrade to TLS 1.0 and beyond is arguably the “fix” for 
CVE-2014-3566 as it is described above).

-- 
Florian Weimer / Red Hat Product Security

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.