HexBrain

MariaDB · Report #514421

smtp service vulnerable to POODLE SSLv3

Validstatus
lowseverity
8upvotes
11 May 2019disclosed

Summary

One of our package servers had an old smtpd service linked with openssl 1.0.1i, which uses nondeterministic CBC padding, making it easy for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue. The service has been disabled for the internet, as it was not necessary to begin with.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original