SSLv3 POODLE Vulnerability: Does Splunk use SSLv3 by default for its transport security protocol?

[a212830]

Hi,

Does Splunk use SSLv3 by default for it's transport? I've read the security announcement, but I'm trying to determine if Splunk uses SSLv3 by default, or only if it's enabled.

[w531t4]

Given that my audit team requires vulnerability scan findings to be completely mitigated, and from the sounds of Splunk's recommended mitigation, I'll need to put a reverse proxy in front of my web-enabled Splunk components. It seems like this is a bit clunky though -- why not include another config option... supportTLSV1Only setting?

Disabling the supportSSLV3Only configuration setting is a double-edged sword.. It allows TLSv1 to happen, but conversely allows SSLv2 to take place.

Come on Splunk! What the heck!?

[piebob]

Splunk does not use SSLv3 by default unless you force it to via the supportSSLV3Only setting. however, setting supportSSLV3Only to OFF does not prevent its usage if a browser requests it.

[aweitzman]

Splunk has a POODLE response here: http://www.splunk.com/view/SP-CAAANKE