Despite being 15 years old, and theoretically replaced by TLS, SSL 3.0 is still in widespread use. As luck would have it, yesterday Google researchers revealed a vulnerability in 3.0 which allows for the decryption of secure connections.

Poodlebleed is a vulnerability in the design of SSL version 3.0. Poodle is actually an acronym for Padding Oracle On Downgraded Legacy Encryption. The vulnerability allows the decryption to plaintext of secure connections. The bug was discovered by Google Security Team researcher Bodo Möller in collaboration with Thai Duong and Krzysztof Kotowicz.

The quick and easy solution is to just disable SSL 3.0 so it’s finally gone for once and for all. If you’re determined to keep supporting it, there seem to be a few options.

Disabling SSL 3.0 support, or CBC-mode ciphers with SSL 3.0, is sufficient to mitigate this issue, but presents significant compatibility problems, even today. Therefore our recommended response is to support TLS_FALLBACK_SCSV. This is a mechanism that solves the problems caused by retrying failed connections and thus prevents attackers from inducing browsers to use SSL 3.0. It also prevents downgrades from TLS 1.2 to 1.1 or 1.0 and so may help prevent future attacks.