Zombie POODLE and GOLDENDOODLE Vulnerabilities

New SSL/TLS vulnerabilities have been published with the names Zombie POODLE, GOLDENDOODLE and Sleeping POODLE [1].

No action required for Airlock WAF

Details:

The vulnerabilities describe a series of TLS CBC padding oracles affecting TLS protocol versions 1.0, 1.1 and 1.2. Airlock WAF supports CBC block cipher mode for backward compatibility only. Since Airlock WAF 7.2, modern clients will negotiate TLS protocol version 1.3 which is not affected. All CBC ciphers have a low priority on Airlock WAF. This means that block cipher modes like GCM or stream ciphers like ChaCha are preferred.

Exploits are known for various TLS implementation but not for OpenSSL.

Information about the related "0-Length OpenSSL" vulnerability can be found in [2].