{"action":"created","issue":{"url":"https://api.github.com/repos/munki/munki/issues/551","labels_url":"https://api.github.com/repos/munki/munki/issues/551/labels{/name}","comments_url":"https://api.github.com/repos/munki/munki/issues/551/comments","events_url":"https://api.github.com/repos/munki/munki/issues/551/events","html_url":"https://github.com/munki/munki/issues/551","id":120885592,"number":551,"title":"Components using gurl.py are vulnerable to POODLE","user":{"login":"vineyard","id":700122,"avatar_url":"https://avatars.githubusercontent.com/u/700122?v=3","gravatar_id":"","url":"https://api.github.com/users/vineyard","html_url":"https://github.com/vineyard","followers_url":"https://api.github.com/users/vineyard/followers","following_url":"https://api.github.com/users/vineyard/following{/other_user}","gists_url":"https://api.github.com/users/vineyard/gists{/gist_id}","starred_url":"https://api.github.com/users/vineyard/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vineyard/subscriptions","organizations_url":"https://api.github.com/users/vineyard/orgs","repos_url":"https://api.github.com/users/vineyard/repos","events_url":"https://api.github.com/users/vineyard/events{/privacy}","received_events_url":"https://api.github.com/users/vineyard/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-12-07T22:40:44Z","updated_at":"2015-12-07T22:50:20Z","closed_at":null,"body":"I noticed this issue in `managedsoftwareupdate`, however any component that uses `gurl.py` for network communication is affected. While testing for man-in-the-middle vulnerabilities, I discovered that `gurl.py` enables SSLv3 with TLS_FALLBACK_SCSV. Enabling TLS_FALLBACK_SCSV with SSLv3 support allows a man-in-the-middle attacker to downgrade the protocol and cipher suite to one that is vulnerable to the [POODLE attack](https://www.openssl.org/~bodo/ssl-poodle.pdf).\r\n\r\nUnfortunately, I don't believe Apple has offered support for setting custom SSL/TLS connection parameters (i.e. cipher suite, protocol version, etc.) until very recently. It looks like it should be possible to use [NSURLSession with NSURLSessionConfiguration](https://developer.apple.com/library/mac/documentation/Foundation/Reference/NSURLSessionConfiguration_class/#//apple_ref/occ/instp/NSURLSessionConfiguration/TLSMaximumSupportedProtocol) on Mac OS X 10.9+ to disable SSLv3 though."},"comment":{"url":"https://api.github.com/repos/munki/munki/issues/comments/162695326","html_url":"https://github.com/munki/munki/issues/551#issuecomment-162695326","issue_url":"https://api.github.com/repos/munki/munki/issues/551","id":162695326,"user":{"login":"arubdesu","id":388808,"avatar_url":"https://avatars.githubusercontent.com/u/388808?v=3","gravatar_id":"","url":"https://api.github.com/users/arubdesu","html_url":"https://github.com/arubdesu","followers_url":"https://api.github.com/users/arubdesu/followers","following_url":"https://api.github.com/users/arubdesu/following{/other_user}","gists_url":"https://api.github.com/users/arubdesu/gists{/gist_id}","starred_url":"https://api.github.com/users/arubdesu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/arubdesu/subscriptions","organizations_url":"https://api.github.com/users/arubdesu/orgs","repos_url":"https://api.github.com/users/arubdesu/repos","events_url":"https://api.github.com/users/arubdesu/events{/privacy}","received_events_url":"https://api.github.com/users/arubdesu/received_events","type":"User","site_admin":false},"created_at":"2015-12-07T22:50:20Z","updated_at":"2015-12-07T22:50:20Z","body":"pinging @pudquick "}}