[asterisk-bugs] [JIRA] (ASTERISK-24425) [patch] jabber/xmpp to use TLS instead of SSLv3, security fix POODLE (CVE-2014-3566)

[Matt Jordan (JIRA)]

    [ https://issues.asterisk.org/jira/browse/ASTERISK-24425?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=223071#comment-223071 ] 

Matt Jordan commented on ASTERISK-24425:
----------------------------------------

I will note that the core {{tcptls}} code defaults to fallback, which is vulnerable to POODLE. So that will have to be updated as well.

> [patch] jabber/xmpp to use TLS instead of SSLv3, security fix POODLE (CVE-2014-3566)
> ------------------------------------------------------------------------------------
>
>                 Key: ASTERISK-24425
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-24425
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: Resources/res_jabber, Resources/res_xmpp
>    Affects Versions: SVN, 1.8.31.0, 11.13.0
>         Environment: AstLinux with Prosody 0.9.6
>            Reporter: abelbeck
>              Labels: Security
>         Attachments: asterisk-11-jabber-xmpp-tls.patch, asterisk-1.8-jabber-tls.patch
>
>
> Asterisk's Jabber and XMPP implementations strictly use SSLv3, which has the POODLE (CVE-2014-3566) security issue.
> The attached patches force a TLS method instead of SSLv3.
> Full disclosure, this is my first forte into OpenSSL specifics and my knowledge is all from online research.  There may be a better way.
> This works in my limited testing.



--
This message was sent by Atlassian JIRA
(v6.2#6252)