SSLv3 Support Disabled By Default Due to POODLE Vulnerability
Oct 14, 2014Matthew Prince
Summary
This post details Cloudflare's immediate response to the POODLE vulnerability affecting SSLv3. It outlines the decision to disable SSLv3 by default across the network, provides statistics on SSLv3 usage to assess impact, and discusses the technical mitigation strategies being explored, such as implementing fallback SCSV to prevent downgrade attacks. It also highlights the availability of an override option for Business and Enterprise customers.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack