Eliminate POODLE risk by disabling SSLv3 and CBC fallback

What's happening

POODLE (Padding Oracle On Downgraded Legacy Encryption, CVE-2014-3566) recovers plaintext from SSLv3 connections one byte at a time using a padding oracle in CBC mode. The 2014 disclosure was followed by POODLE-on-TLS (CVE-2014-8730), which extends the attack to certain TLS implementations that share SSLv3-style CBC padding logic.

POODLE requires the attacker to force the connection onto SSLv3, typically via a downgrade attack: the attacker drops the legitimate ClientHello and replays a degraded version. TLS_FALLBACK_SCSV (RFC 7507) is a defense that lets clients flag a fallback retry; servers refuse the retry if a higher version was originally available.

The fix is to disable SSLv3 entirely (it has been deprecated since 2014), restrict to TLS 1.2 and 1.3 cipher suites that use AEAD modes (which have no padding oracle), and ensure both client and server understand TLS_FALLBACK_SCSV.

Why it matters

An attacker on the victim's network can recover authentication cookies and other sensitive plaintext byte-by-byte. Recovery rate is slow but tractable; demos in 2014 recovered cookies in under five minutes per byte target.

PCI-DSS scanners flag any host accepting SSLv3 as immediately non-compliant. SSL Labs grades drop to F.

POODLE-on-TLS persists on misconfigured TLS implementations even after SSLv3 is disabled. Some hardware load balancers had vulnerable CBC implementations until firmware updates years later.

Common causes

• Server still advertises SSLv3 because of a permissive ssl_protocols line.
• Cipher list includes CBC-mode suites without proper anti-padding-oracle countermeasures.
• TLS_FALLBACK_SCSV not supported on a legacy server build.
• Hardware load balancer firmware has known POODLE-on-TLS issue and was never patched.
• An admin re-enabled SSLv3 to support a single legacy client and forgot to remove the override.

Detect this on your site

Run a quick scan with the SSL Checker. The tool surfaces this exact issue with the records and context needed to apply the fix below.

How to fix it

1. 1

   Confirm SSLv3 is offered

   Run nmap --script ssl-enum-ciphers -p 443 example.com | grep -i ssl. Any line referencing SSLv3 means the server still negotiates it. Also probe with openssl s_client -ssl3 -connect example.com:443 — if the handshake completes, SSLv3 is enabled.

2. 2

   Disable SSLv3 in nginx

   Set ssl_protocols TLSv1.2 TLSv1.3; in the http or server block. Do not list SSLv3, SSLv2, or TLSv1/TLSv1.1. Reload nginx with sudo nginx -t && sudo systemctl reload nginx.

3. 3

   Disable SSLv3 in Apache

   Set SSLProtocol all -SSLv3 -SSLv2 -TLSv1 -TLSv1.1 in the VirtualHost. The negative-list form is safe against future protocol additions. Reload Apache with sudo systemctl reload apache2.

4. 4

   Restrict to AEAD cipher suites

   Use the Mozilla intermediate cipher list, which contains only AEAD suites (GCM and CHACHA20-Poly1305). AEAD modes have no padding and therefore no padding-oracle attack. CBC-mode suites should not appear at all.

5. 5

   Verify TLS_FALLBACK_SCSV support

   Modern OpenSSL handles TLS_FALLBACK_SCSV automatically. Re-run testssl.sh to confirm the result reads 'TLS_FALLBACK_SCSV (RFC 7507): Downgrade attack prevention supported'. If a hardware load balancer is in the path, check the firmware.

6. 6

   Re-scan and document

   Re-run nmap, testssl.sh, and SSL Labs. The grade should rise to A, with no SSLv3 line and no POODLE flag. Add the protocol enforcement to your infrastructure-as-code so a regression cannot ship.

Example

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;

TLS 1.2/1.3 with AEAD-only ciphers eliminates POODLE

Related fixes