[PROTON-716] Reject SSL clients that attempt to use SSLv3

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: proton-0.8
• Fix Version/s: proton-0.8
• Component/s: proton-c
• Assignee: Ken Giusti
• Reporter: Ken Giusti
• Created: 15/Oct/14 17:47
• Updated: 07/Jan/16 11:36
• Resolved: 16/Oct/14 13:05

Description

SSLv3 is vulnerable to CVE-2014-3566, and will not fixed. See:

https://securityblog.redhat.com/2014/10/15/poodle-a-ssl3-vulnerability-cve-2014-3566/

By default, all clients based on Proton/C will use TLSv1 and are therefore not affected by this CVE.

However, a server based on Proton/C will allow clients to connect using either TLSv1 or SSLv3, as it allowed for older clients that had not upgraded to SSLv3.

Since SSLv3 is no longer considered secure, we should prevent Proton/C from accepting v3-based SSL connections.