Hello folks, in relation to the recent SSLv3 CVE-2014-3566 / "POODLE" flaw: [1] http://fedoramagazine.org/what-you-need-to-know-about-the-sslv3-poodle-flaw-cve-2014-3566/ got wondering if there's anything SSG should do to react against it. Possibly to add / update system service rules checking for system SSL version that it is higher than SSLv3? [1] suggest httpd would be one candidate, but I am sure there would be more of them. Should this be investigated further & particular rules updated? Thanks && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team P.S.: For those possibly wondering the proposal is not to add rule checking particular package version is >= than the updated version disabling use of SSLv3 (IOW not to perform the CVE check itself). But rather check configuration of possibly affected system services, if they aren't using SSLv3 via their configuration files (since setting default SSL version higher than SSLv3 is one thing, but actually checking if that version isn't enabled again [by administrator] an another one).
set the SSLProtocol directive as follows in /etc/httpd/conf.d/ssl.conf:
Disable everything except TLSv1.xOn RHEL 7 or RHEL 6.6 and later:
SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2