[asterisk-bugs] [JIRA] (ASTERISK-24425) [patch] jabber/xmpp to use TLS instead of SSLv3, security fix POODLE (CVE-2014-3566)

[Matt Jordan (JIRA)]

     [ https://issues.asterisk.org/jira/browse/ASTERISK-24425?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Matt Jordan updated ASTERISK-24425:
-----------------------------------

    Target Release Version/s: 1.8.31.1
                              11.13.1
                              12.6.1
                              13.0.0-beta3
                    Security:     (was: Reporter, Bug Marshals, and Digium)

> [patch] jabber/xmpp to use TLS instead of SSLv3, security fix POODLE (CVE-2014-3566)
> ------------------------------------------------------------------------------------
>
>                 Key: ASTERISK-24425
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-24425
>             Project: Asterisk
>          Issue Type: Bug
>          Components: Resources/res_jabber, Resources/res_xmpp
>    Affects Versions: SVN, 1.8.31.0, 11.13.0
>         Environment: AstLinux with Prosody 0.9.6
>            Reporter: abelbeck
>              Labels: Security
>      Target Release: 1.8.31.1, 11.13.1, 12.6.1, 13.0.0-beta3
>
>         Attachments: AST-2014-011-11.diff, AST-2014-011-12.diff, AST-2014-011-1.8.diff, asterisk-11-jabber-xmpp-tls.patch, asterisk-1.8-jabber-tls.patch
>
>
> Asterisk's Jabber and XMPP implementations strictly use SSLv3, which has the POODLE (CVE-2014-3566) security issue.
> The attached patches force a TLS method instead of SSLv3.
> Full disclosure, this is my first forte into OpenSSL specifics and my knowledge is all from online research.  There may be a better way.
> This works in my limited testing.



--
This message was sent by Atlassian JIRA
(v6.2#6252)