New vulnerabilities on CBC TLS ciphers

Quote:

---

Recently new vulnerabilities like Zombie POODLE, GOLDENDOODLE, 0-Length OpenSSL and Sleeping POODLE were published for websites that use CBC (Cipher Block Chaining) block cipher modes. These vulnerabilities are applicable only if the server uses TLS 1.2 or TLS 1.1 or TLS 1.0 with CBC cipher modes.

---

https://www.tripwire.com/state-of-se...zombie-poodle/
https://www.tripwire.com/state-of-se...doodle-attack/
https://nvd.nist.gov/vuln/detail/CVE-2019-1559
https://i.blackhat.com/asia-19/Fri-M...ave-Us-All.pdf
https://www.tripwire.com/state-of-se...dding-oracles/

Another reason to push TLS 1.3 as much and as quickly as possible. ssllabs.com is already marking all CBC cipher suites, as well as versions of TLS lower than 1.2, as "weak".