Company
Date Published
Author
Don Pinto, Principal Product Manager, Couchbase
Word count
454
Language
English
Hacker News points
None

Summary

SSL version 3 is no longer secure due to the newly discovered `Poodle attack' vulnerability in its CBC encryption scheme. This issue arises when clients downgrade their cryptographic protocol to SSL 3.0, posing a risk to systems using TLS as its successor. To mitigate this threat, Couchbase has taken measures such as disabling SSLv3 for management, views, and memcached ports in version 3.0.1, while advising users to upgrade their front-end client apps and infrastructure components that rely on SSL v3. Additionally, securing the entire stack involves patching third-party proxy servers like Apache, nginx, and HAProxy, as well as checking Amazon EC2 security advisories. Users can find more information in Google's security advisory paper and discussions in the Erlang community.