Skip to main content
ExLibris

Knowledge Assistant

BETA
 
  • Subscribe by RSS
  • Back
    Cross-Product

     

    Ex Libris Knowledge Center
    1. Search site
      Go back to previous article
      1. Sign in
        • Sign in
        • Forgot password
    1. Home
    2. Cross-Product
    3. Security
    4. Advisories
    5. Security Advisory-“POODLE” – The SSL v3 Security vulnerability update

    Security Advisory-“POODLE” – The SSL v3 Security vulnerability update

    1. Last updated
    2. Save as PDF
    3. Share
      1. Share
      2. Tweet
      3. Share
    1. Subject: “POODLE” – The SSL v3 Security vulnerability update
      1. Overview
      2. Effective Security Severity level:
      3. Affected systems:
      4. How do I know if I have an SSL certificate on my Ex Libris product?
      5. Immediate remediation:
      6. Tests and certifications:
      7. Actions to be taken for Hosted systems:
      8. Required action for on-premise/local systems:

    Subject: “POODLE” – The SSL v3 Security vulnerability update

    Overview

    Ex Libris has been made aware of a recently discovered a vulnerability that dubbed “POODLE”.

    A bug has been found in the Secure Sockets Layer (SSL) 3.0 cryptography protocol (SSLv3) which could be exploited to intercept data that’s supposed to be encrypted between clients and servers. 

    This vulnerability allows man-in-the-middle, such as a malicious Wi-Fi hotspot or a compromised ISP, to extract data from secure HTTP connections.

    The vulnerability depends on the fact that most Web servers and Web browsers allow the use of the obsolete SSL version 3.0 protocol to secure their communications. Although SSL has been superseded by Transport Layer Security (TLS 1.2 is the latest published version of the protocol), it's still widely supported on both servers and clients alike and is still required for compatibility with legacy systems. 

    TLS 1.0 and newer versions perform more robust validation of the decrypted data and as such are not susceptible to the same problem.

    The vulnerability is covered by two NIST advisories in the National Vulnerability Database CVE-20143566 where more information is available. 

    Risk Level: NIST rate is as medium. 

    In addition more detailed analysis of the vulnerability is available from RedHat - https://access.redhat.com/articles/1232123 and Symantec-  
    http://www.symantec.com/connect/blog...ka-poodlebleed

    Effective Security Severity level:

    Medium

    Affected systems:

    All systems/products that are using SSL certificate.

    How do I know if I have an SSL certificate on my Ex Libris product?
    1. Examine the URL of the website on the address bar of your Web browser. A website with SSL certificate has an URL that starts with "https" instead of the usual "http."
    2. Notice an icon that looks like a lock at the left hand side of the address bar of your Web browser. You may also find it at the lower-right of the browser window. Double-click on it to see the website security certificate. It should say "Secured Socket layer (SSL)" somewhere.
    Immediate remediation:

    The vulnerability described above requires an SSL 3.0 connection to be established, so disabling the SSL 3.0 protocol in the client or in the server (or both) will completely avoid it.

    To mitigate this vulnerability, it is recommended that you explicitly disable SSL 3.0 on all servers running Ex Libris systems/products. It is important to know that if the library users are using the latest browser versions, typically the browser will use TLS encryption mechanism, and not the vulnerable SSL v3 encryption mechanism.

    Tests and certifications:

    Ex Libris is in the process of evaluating all Ex Libris products for potential vulnerability and performing certification testing after disabling SSL 3.0 with all Ex Libris systems/products.

    Actions to be taken for Hosted systems:

    Ex Libris will deploy the required configuration to all Ex Libris cloud servers once all Ex Libris products will be fully tested and passed certification testing.

    Required action for on-premise/local systems:


    Once all Ex Libris products passed the certification testing, Ex Libris will recommend the customers with on-premise/local systems to follow their server’s  vendor instructions, and disable SSL 3.0.  


     

     

     

    View article in the Exlibris Knowledge Center
    1. Back to top
      • Advisories
      • Security Advisory- “Shellshock” - Security vulnerability – update September 29, 2014
    • Was this article helpful?

    Recommended articles

    1. Article type
      Topic
      Content Type
      Documentation
      Language
      English
      Product
      Cross-Product
    2. Tags
      This page has no tags.
    1. © Copyright 2025 Ex Libris Knowledge Center
    2. Powered by CXone Expert ®
    • Term of Use
    • Privacy Policy
    • Contact Us
    2025 Ex Libris. All rights reserved