GNOME Bugzilla – Bug 739963
Disable SSLv3 because of POODLE
Last modified: 2014-11-11 14:19:33 UTC
In order to respond to the POODLE attack we need to disable SSLv3 in code that uses WebKit (or any web browser, for that matter). Currently the only way to turn off SSLv3 in glib-networking is to use an environment variable (see bug 738633). This means that we need to set it very early in process startup, so we can not do it anywhere further down the stack. It needs to be done early in main(). Note that once we migrate to WK2 we won't have to do it in every application, because the WK2 network process will be doing it for us. Also see: https://bugzilla.gnome.org/show_bug.cgi?id=738633#c18
hmm, I'll have to do a 3.14.2.1 for this then, please push the same patch
Created attachment 290416 [details] [review] Disable SSLv3 because of POODLE