[stunnel-users] SSLv3 connections vulnerable in my environment?
droppl at yahoo.ca
Tue Oct 21 21:09:05 CEST 2014
I have a pretty standard stunnel server configuration with verify = 2
and clients, that don't speak TLS and can't easily be upgraded to
support TLS. So disabling SSLv3 leads to handshake errors, I need to
leave it enabled for now.
The SSL connection is always renegotiated, a proprietary protocol is
used inside SSL, and clients can be considered safe.
Can the poodle security flaw realistically be used by a man in the
middle to decrypt packets send over such an SSLv3 connection?
If so, is there any other way to protect against the attack?
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the stunnel-users