2

SSL 3.0 library suffers from POODLE attack.

OpenSSL's latest version is 1.0.1h as of now.

Does OpenSSL also suffer from the same attack ?

I couldn't find any related info either on google or OpenSSL forum.

I use a openvpn android client which uses OpenSSL 1.0.1 h that is why I am worried.

Any help is appreciated.

Thanks in advance !

Shravan
  • 540
  • 6
  • 24

1 Answers1

4

Yes OpenSSL 1.0.1h suffers from the POODLE attack.

But you don't have to worry as OpenVPN has always been strictly TLS 1.0 or TLS 1.0+ and since OpenVPN 2.x never supported SSLv3 or SSLv3 fallback as well.

Here is a link for your reference

Hope this helps

Durai Amuthan.H
  • 31,670
  • 10
  • 160
  • 241