7016 2014-12-03 07:03:20 +0000 wget: investigate if wget is affected by "Poodle" (CVE-2014-3566) 2015-03-18 12:12:33 +0000 1 1 7 Build System, Metadata & Runtime OE-Core connectivity 1.8 x86 Multiple VERIFIED FIXED Medium+ normal 1.8 M2 1 sona.sarmadi sona.sarmadi bogdanx.a.voiculescu meta.mr.watcher meta.watcher sgw georgex.l.musat --- --- Don't know oldest_to_newest 47312 0 sona.sarmadi 2014-12-03 07:03:20 +0000 Investigate if wget needs to be patched for SSLV3 vulnerability? See: https://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg1276641.html We need also investigate if we need to update documentation. 47734 1 sona.sarmadi 2015-01-05 20:09:51 +0000 Wget *explicitely* asks for SSLv2 and SSLv3 in the default configuration when compiled with OpenSSL. There is a pacth avaiable "do not use SSLv3 except explicitely requested": http://lists.gnu.org/archive/html/bug-wget/2014-10/txtFVqLh6aCiB.txt Reference: http://lists.gnu.org/archive/html/bug-wget/2014-10/msg00074.html I will test this pacth and send it to OE-core soon. 47735 2 sona.sarmadi 2015-01-05 21:29:08 +0000 This patch seems to be already present in v1.16: commit 6fc11e46ec736c0497b810a13b13430b7f15464b Author: Tim Ruehsen <tim.ruehsen@gmx.de> Date: Thu Oct 16 20:44:56 2014 +0200 do not use SSLv3 except explicitely requested 47736 3 sona.sarmadi 2015-01-05 21:31:44 +0000 This patch seems to be already present in 1.16. 49534 4 georgex.l.musat 2015-03-18 12:12:33 +0000 Verified as per third and fourth comment. Wget v1.16 has the SSLv3 patch.