Message229368
Copy of Donald Stuff email sent to python-dev:
A big security breach of SSL 3.0 just dropped a little while ago (named POODLE).
With this there is now no ability to securely connect via SSL 3.0. I believe
that we should disable SSL 3.0 in Python similarly to how SSL 2.0 is disabled,
where it is disabled by default unless the user has explicitly re-enabled it.
The new attack essentially allows reading the sensitive data from within a SSL
3.0 connection stream. It takes roughly 256 requests to break a single byte so
the attack is very practical. You can read more about the attack here at the
google announcement [1] or the whitepaper [2].
[1] http://googleonlinesecurity.blogspot.com/2014/10/this-poodle-bites-exploiting-ssl-30.html
[2] https://www.openssl.org/~bodo/ssl-poodle.pdf |
|
Date |
User |
Action |
Args |
2014-10-14 23:11:15 | vstinner | set | recipients:
+ vstinner |
2014-10-14 23:11:15 | vstinner | set | messageid: <1413328275.88.0.275500633746.issue22638@psf.upfronthosting.co.za> |
2014-10-14 23:11:15 | vstinner | link | issue22638 messages |
2014-10-14 23:11:15 | vstinner | create | |
|