MariaDB · Report #514421
smtp service vulnerable to POODLE SSLv3
Validstatus
lowseverity
8upvotes
11 May 2019disclosed
Summary
One of our package servers had an old smtpd service linked with openssl 1.0.1i, which uses nondeterministic CBC padding, making it easy for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue. The service has been disabled for the internet, as it was not necessary to begin with.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.