After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 739960 - Disable SSLv3 because of POODLE
Disable SSLv3 because of POODLE
Status: RESOLVED FIXED
Product: gnome-control-center
Classification: Core
Component: Online Accounts
3.14.x
Other All
: Normal normal
: ---
Assigned To: GNOME Online Accounts maintainer(s)
Control-Center Maintainers
Depends on:
Blocks:
 
 
Reported: 2014-11-11 13:09 UTC by Debarshi Ray
Modified: 2014-11-11 14:18 UTC
See Also:
GNOME target: ---
GNOME version: ---

Attachments
main: Disable SSLv3 because of POODLE (932 bytes, patch)
2014-11-11 13:13 UTC, Debarshi Ray 		accepted-commit_now Details | Review
main: Disable SSLv3 because of POODLE (983 bytes, patch)
2014-11-11 14:13 UTC, Debarshi Ray 		committed Details | Review

Description Debarshi Ray 2014-11-11 13:09:25 UTC 
In order to respond to the POODLE attack we need to disable SSLv3 in code that uses WebKit (or any web browser, for that matter). Currently the only way to turn off SSLv3 in glib-networking is to use an environment variable (see bug 738633). This means that we need to set it very early in process startup, so we can not do it anywhere further down the stack. It needs to be done early in main().

Note that once we migrate to WK2 we won't have to do it in every application, because the WK2 network process will be doing it for us.

Also see:
https://bugzilla.gnome.org/show_bug.cgi?id=738633#c18
Comment 1 Debarshi Ray 2014-11-11 13:13:55 UTC 
Created attachment 290413 [details] [review]
main: Disable SSLv3 because of POODLE
Comment 2 Rui Matos 2014-11-11 13:43:52 UTC 
Review of attachment 290413 [details] [review]:

Sucks that we have to do this via env vars. Anyway, ok

I know it's already mentioned in the commit body but a /* FIXME: remove this when ... */ above the code is likely a good idea to make it less likely we'll forget to remove it at some point.
Comment 3 Debarshi Ray 2014-11-11 14:13:23 UTC 
Created attachment 290417 [details] [review]
main: Disable SSLv3 because of POODLE

Add a FIXME in the code.