Index: UPGRADE.txt
===================================================================
--- UPGRADE.txt	(revision 426052)
+++ UPGRADE.txt	(revision 426053)
@@ -20,6 +20,18 @@
 ===
 ===========================================================
 
+from 11.6-cert6 to 11.6-cert7:
+
+* Due to the POODLE vulnerability (see 
+  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566), the
+  default TLS method for TLS clients will no longer allow SSLv3. As
+  SSLv2 was already deprecated, it is no longer allowed by default as
+  well. TLS servers no longer allow SSLv2 or SSLv3 connections. This
+  affects the chan_sip channel driver, AMI, and the Asterisk HTTP server.
+
+* The res_jabber resource module no longer uses SSLv3 to connect to an
+  XMPP server. It will now only use TLSv1 or later methods.
+
 From 11.6-cert2 to 11.6-cert3:
 * MixMonitor AMI actions now require users to have authorization classes.
   * MixMonitor - system
Index: main/tcptls.c
===================================================================
--- main/tcptls.c	(revision 426052)
+++ main/tcptls.c	(revision 426053)
@@ -741,6 +741,8 @@
 	cfg->enabled = 0;
 	return 0;
 #else
+	int disable_ssl = 0;
+ 
 	if (!cfg->enabled) {
 		return 0;
 	}
@@ -756,22 +758,21 @@
 	if (client) {
 #ifndef OPENSSL_NO_SSL2
 		if (ast_test_flag(&cfg->flags, AST_SSL_SSLV2_CLIENT)) {
+			ast_log(LOG_WARNING, "Usage of SSLv2 is discouraged due to known vulnerabilities. Please use 'tlsv1' or leave the TLS method unspecified!\n");
 			cfg->ssl_ctx = SSL_CTX_new(SSLv2_client_method());
 		} else
 #endif
 		if (ast_test_flag(&cfg->flags, AST_SSL_SSLV3_CLIENT)) {
+			ast_log(LOG_WARNING, "Usage of SSLv3 is discouraged due to known vulnerabilities. Please use 'tlsv1' or leave the TLS method unspecified!\n");
 			cfg->ssl_ctx = SSL_CTX_new(SSLv3_client_method());
 		} else if (ast_test_flag(&cfg->flags, AST_SSL_TLSV1_CLIENT)) {
 			cfg->ssl_ctx = SSL_CTX_new(TLSv1_client_method());
 		} else {
-			/* SSLv23_client_method() sends SSLv2, this was the original
-			 * default for ssl clients before the option was given to
-			 * pick what protocol a client should use.  In order not
-			 * to break expected behavior it remains the default. */
+			disable_ssl = 1;
 			cfg->ssl_ctx = SSL_CTX_new(SSLv23_client_method());
 		}
 	} else {
-		/* SSLv23_server_method() supports TLSv1, SSLv2, and SSLv3 inbound connections. */
+		disable_ssl = 1;
 		cfg->ssl_ctx = SSL_CTX_new(SSLv23_server_method());
 	}
 
@@ -781,6 +782,17 @@
 		return 0;
 	}
 
+	/* Due to the POODLE vulnerability, completely disable
+	 * SSLv2 and SSLv3 if we are not explicitly told to use
+	 * them. SSLv23_*_method supports TLSv1+.
+	 */
+	if (disable_ssl) {
+		long ssl_opts;
+
+		ssl_opts = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3;
+		SSL_CTX_set_options(cfg->ssl_ctx, ssl_opts);
+	}
+
 	SSL_CTX_set_verify(cfg->ssl_ctx,
 		ast_test_flag(&cfg->flags, AST_SSL_VERIFY_CLIENT) ? SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT : SSL_VERIFY_NONE,
 		NULL);
Index: res/res_xmpp.c
===================================================================
--- res/res_xmpp.c	(revision 426052)
+++ res/res_xmpp.c	(revision 426053)
@@ -2501,6 +2501,7 @@
 {
 #ifdef HAVE_OPENSSL
 	int sock;
+	long ssl_opts;
 #endif
 
 	if (!strcmp(iks_name(node), "success")) {
@@ -2519,11 +2520,14 @@
 	ast_log(LOG_ERROR, "Somehow we managed to try to start TLS negotiation on client '%s' without OpenSSL support, disconnecting\n", client->name);
 	return -1;
 #else
-	client->ssl_method = SSLv3_method();
+	client->ssl_method = SSLv23_method();
 	if (!(client->ssl_context = SSL_CTX_new((SSL_METHOD *) client->ssl_method))) {
 		goto failure;
 	}
 
+	ssl_opts = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3;
+	SSL_CTX_set_options(client->ssl_context, ssl_opts);
+
 	if (!(client->ssl_session = SSL_new(client->ssl_context))) {
 		goto failure;
 	}
Index: res/res_jabber.c
===================================================================
--- res/res_jabber.c	(revision 426052)
+++ res/res_jabber.c	(revision 426053)
@@ -1282,14 +1282,17 @@
 static int aji_tls_handshake(struct aji_client *client)
 {
 	int sock;
+	long ssl_opts;
 
 	ast_debug(1, "Starting TLS handshake\n");
 
 	/* Choose an SSL/TLS protocol version, create SSL_CTX */
-	client->ssl_method = SSLv3_method();
+	client->ssl_method = SSLv23_method();
 	if (!(client->ssl_context = SSL_CTX_new((SSL_METHOD *) client->ssl_method))) {
 		return IKS_NET_TLSFAIL;
 	}
+	ssl_opts = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3;
+	SSL_CTX_set_options(client->ssl_context, ssl_opts);
 
 	/* Create new SSL session */
 	if (!(client->ssl_session = SSL_new(client->ssl_context))) {
Index: .
===================================================================
--- .	(revision 426052)
+++ .	(revision 426053)

Property changes on: .
___________________________________________________________________
Modified: branch-11-merged
## -1 +1 ##
-/branches/11:396884,399513,400075-400093,401446,401960,402345-402406,402408-402424,402426-402468,402470-402604,402606-402645,402647-402685,402687-402708,402710-403014,403016-403287,403289-403449,403451-403634,403636-403854,403856-404044,404046-404086,404088-404135,404137-404218,404220-404274,404276-404317,404319-404350,404352-404456,404458-404578,404580-404603,404605-404674,404676-404772,404774-404784,404786-404857,404859-405080,405082-405088,405090,405092-405160,405162-405280,405282-405361,405363-405433,405435-405486,405488-405581,405583-405692,405694-405744,405746-405791,405793-405926,405928-406037,406039-406079,406081-406170,406172-406216,406218-406244,406246-406360,406362-406399,406401-406514,406516-406566,406568-406643,406645-406721,406723-406801,406803-406860,406862-406917,406919-406933,406935-407073,407075-407102,407104-407209,407211-407272,407274-407337,407339-407455,407458-407511,407513-407622,407624-407764,407766-407817,407819-407856,407858-407873,407875-408020,408022-408083,408085-408136,408138-408142,408144-408192,408194-408200,408202-408311,408313-408329,408331-408447,408449-408536,408538-408589,408591-408642,408644-408646,408648-408728,408730-408732,408734-408747,408749-408785,408787-408837,408839-408876,408878-409001,409003-409052,409054-409082,409084-409156,409158-409207,409209-409254,409256-409343,409345-409361,409363-409472,409474-409523,409525-409566,409568-409624,409626-409680,409682-409702,409704-409744,409746-409760,409762-409777,409779-409828,409830-409833,409835-409885,409887-409916,409918-409989,409991-410043,410045-410105,410107-410224,410226-410489,410491-410555,410557-410605,410607-410608,410610-410716,410718-410748,410750-410828,410830-410964,410966-411021,411023-411088,411090-411189,411191-411243,411245-411309,411311-411313,411315-411372,411374-411407,411409-411457,411459-411462,411464-411530,411532-411584,411586-411632,411634-411715,411717-411807,411809-411943,411945-411960,411962-411973,411975-412114,412116-412225,412227-412304,412306-412328,412330-412347,412349-412467,412469-412481,412483-412585,412587-412655,412657-412711,412713-412745,412747,412749-412766,412768-412821,412823-412922,412924-413122,413124-413138,413140-413224,413226-413250,413252-413304,413306-413396,413398-413450,413452-413485,413487-413550,413552-413586,413588-413594,413596-413694,413696-413709,413711-413787,413789-413790,413792-413837,413839-413875,413877-413894,413896-413949,413951-413991,413993-414049,414051-414067,414069-414152,414154-414214,414216-414269,414271-414345,414347-414401,414403-414488,414490-414564,414566-414627,414629-414676,414678-414693,414695-414858,414860-414880,414882-414997,414999-415065,415067-415170,415172-415205,415207-415228,415230-415389,415391-415463,415465-415521,415523-415598,415600-415727,415729-415824,415826-415834,415836,415838-415914,415916-415998,416000-416150,416152-416251,416253-416336,416338-416439,416441-416500,416502-416580,416582-416667,416669-416732,416734-416869,416871-416929,416931-417016,417018-417076,417078-417248,417250-417309,417311-417319,417321-417418,417420-417480,417482-417504,417506-417587,417589-417677,418366,419284,419631,420435,423360
\ No newline at end of property
+/branches/11:396884,399513,400075-400093,401446,401960,402345-402406,402408-402424,402426-402468,402470-402604,402606-402645,402647-402685,402687-402708,402710-403014,403016-403287,403289-403449,403451-403634,403636-403854,403856-404044,404046-404086,404088-404135,404137-404218,404220-404274,404276-404317,404319-404350,404352-404456,404458-404578,404580-404603,404605-404674,404676-404772,404774-404784,404786-404857,404859-405080,405082-405088,405090,405092-405160,405162-405280,405282-405361,405363-405433,405435-405486,405488-405581,405583-405692,405694-405744,405746-405791,405793-405926,405928-406037,406039-406079,406081-406170,406172-406216,406218-406244,406246-406360,406362-406399,406401-406514,406516-406566,406568-406643,406645-406721,406723-406801,406803-406860,406862-406917,406919-406933,406935-407073,407075-407102,407104-407209,407211-407272,407274-407337,407339-407455,407458-407511,407513-407622,407624-407764,407766-407817,407819-407856,407858-407873,407875-408020,408022-408083,408085-408136,408138-408142,408144-408192,408194-408200,408202-408311,408313-408329,408331-408447,408449-408536,408538-408589,408591-408642,408644-408646,408648-408728,408730-408732,408734-408747,408749-408785,408787-408837,408839-408876,408878-409001,409003-409052,409054-409082,409084-409156,409158-409207,409209-409254,409256-409343,409345-409361,409363-409472,409474-409523,409525-409566,409568-409624,409626-409680,409682-409702,409704-409744,409746-409760,409762-409777,409779-409828,409830-409833,409835-409885,409887-409916,409918-409989,409991-410043,410045-410105,410107-410224,410226-410489,410491-410555,410557-410605,410607-410608,410610-410716,410718-410748,410750-410828,410830-410964,410966-411021,411023-411088,411090-411189,411191-411243,411245-411309,411311-411313,411315-411372,411374-411407,411409-411457,411459-411462,411464-411530,411532-411584,411586-411632,411634-411715,411717-411807,411809-411943,411945-411960,411962-411973,411975-412114,412116-412225,412227-412304,412306-412328,412330-412347,412349-412467,412469-412481,412483-412585,412587-412655,412657-412711,412713-412745,412747,412749-412766,412768-412821,412823-412922,412924-413122,413124-413138,413140-413224,413226-413250,413252-413304,413306-413396,413398-413450,413452-413485,413487-413550,413552-413586,413588-413594,413596-413694,413696-413709,413711-413787,413789-413790,413792-413837,413839-413875,413877-413894,413896-413949,413951-413991,413993-414049,414051-414067,414069-414152,414154-414214,414216-414269,414271-414345,414347-414401,414403-414488,414490-414564,414566-414627,414629-414676,414678-414693,414695-414858,414860-414880,414882-414997,414999-415065,415067-415170,415172-415205,415207-415228,415230-415389,415391-415463,415465-415521,415523-415598,415600-415727,415729-415824,415826-415834,415836,415838-415914,415916-415998,416000-416150,416152-416251,416253-416336,416338-416439,416441-416500,416502-416580,416582-416667,416669-416732,416734-416869,416871-416929,416931-417016,417018-417076,417078-417248,417250-417309,417311-417319,417321-417418,417420-417480,417482-417504,417506-417587,417589-417677,418366,419284,419631,420435,423360,425986
\ No newline at end of property
