Hi,
Does Splunk use SSLv3 by default for it's transport? I've read the security announcement, but I'm trying to determine if Splunk uses SSLv3 by default, or only if it's enabled.
Given that my audit team requires vulnerability scan findings to be completely mitigated, and from the sounds of Splunk's recommended mitigation, I'll need to put a reverse proxy in front of my web-enabled Splunk components. It seems like this is a bit clunky though -- why not include another config option... supportTLSV1Only setting?
Disabling the supportSSLV3Only configuration setting is a double-edged sword.. It allows TLSv1 to happen, but conversely allows SSLv2 to take place.
Come on Splunk! What the heck!?
Splunk does not use SSLv3 by default unless you force it to via the supportSSLV3Only setting. however, setting supportSSLV3Only to OFF does not prevent its usage if a browser requests it.
Splunk has a POODLE response here: http://www.splunk.com/view/SP-CAAANKE