--- title: POODLE Security Update description: POODLE Security Update --- - [CCPA](https://safe.truevault.com/learn/ccpa/what-is-the-ccpa) - [GDPR Compliance](https://safe.truevault.com/gdpr-guide) - [HIPAA](https://safe.truevault.com/learn/hipaa) - [HIPAA Compliance](https://safe.truevault.com/blog/hipaa-compliance-checklist-download.html) - [Personally Identifiable Information](https://safe.truevault.com/blog/what-is-pii) - [PHI](https://safe.truevault.com/protected-health-information) - [Resources](https://safe.truevault.com/learn/) - Login [TrueVault Safe Log in to TrueVault Safe](https://console.truevault.com) [TrueVault Polaris Log in to TrueVault Polaris](https://polaris.truevault.com) - [Resources](https://safe.truevault.com/learn/) - Login - Login - [TrueVault Safe Log in to TrueVault Safe](https://console.truevault.com) - [TrueVault Polaris Log in to TrueVault Polaris](https://polaris.truevault.com) [Blog](https://safe.truevault.com/blog) - [Home](https://www.truevault.com/index.html) - [Blog](https://safe.truevault.com/blog) # POODLE Security Update By Jason Wang/ Published on October 16, 2014 Yesterday, an embargo on a major vulnerability with SSL named POODLE ended \[0\]. This vulnerability POODLE (Padding Oracle On Downgraded Legacy Encryption) is caused by downgrading of SSL connection from TLS to to SSLv3 and then exploiting SSLv3's weak ciphers to steal "secure" HTTP cookies/tokens/headers. More details about the vulnerability can be found in the release drafted by Google on the OpenSSL website\[1\]. This vulnerability did not affect TrueVault. In fact, TrueVault removed support for SSLv3 some time ago. TrueVault has been closely monitoring all API traffic for suspicious and irregular activities, and have not found any activities that may suggest cookies/tokens/headers were hijacked. Unless you must support SSLv3 (due to legacy requirements, e.g. Windows XP with IE6), TrueVault’s security team recommends our customers to only support TLSv1, TLSv1.1, and TLSv1.2 for SSL. TrueVault highly recommends our customers follow the guidelines and recommendation set by the security community such as Mozilla \[2\] to secure their infrastructure. As always, should you have any questions about POODLE or our security practices, don’t hesitate to email our security team at [security@truevault.com](mailto:security@truevault.com) \[0\] [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566) \[1\] [https://www.openssl.org/~bodo/ssl-poodle.pdf](https://www.openssl.org/~bodo/ssl-poodle.pdf) \[2\] [https://wiki.mozilla.org/Security/ServerSideTLS](https://wiki.mozilla.org/Security/Server_Side_TLS) ### Latest Posts ## [Should Utah's Privacy Law Be on Your Radar?](https://safe.truevault.com/blog/utah-privacy-law-does-it-apply) Phillip Walters / November 17, 2022 ## [Connecticut’s Privacy Law: Does It Apply to Your Business?](https://safe.truevault.com/blog/connecticut-privacy-law-does-it-apply) Phillip Walters / November 10, 2022 ## [Global Privacy Control: A New Requirement for Compliance](https://safe.truevault.com/blog/global-privacy-control) Phillip Walters / November 7, 2022 ## [A Cookie Banner Isn't Enough for CCPA Compliance](https://safe.truevault.com/blog/a-cookie-banner-isnt-enough) Phillip Walters / October 27, 2022 ## [Why CCPA Compliance Matters to HR](https://safe.truevault.com/blog/why-ccpa-matters-to-hr) Phillip Walters / October 21, 2022 ### Mailing List ### Company - [Blog](https://safe.truevault.com/blog) - [Contact Us](https://safe.truevault.com/contact-us-2019) - [Careers](https://truevault.workable.com) - [HIPAA Compliance Checklist](https://safe.truevault.com/blog/hipaa-compliance-checklist-download.html) - [PDF: Developers Guide to HIPAA compliance](https://my.leadpages.net/leadbox/14472b173f72a2%3A131fd12f8b46dc/5760820306771968/) ### Developers - [Patterns](https://safe.truevault.com/patterns) - [Documentation](https://docs.truevault.com/) - [Quick Start Guide](https://safe.truevault.com/quick-start-guide) - [Secure Infrastructure](https://safe.truevault.com/secure-infrastructure) - [API Overview](https://safe.truevault.com/api-overview) ### Latest Posts ### Contact Us 201 Mission Street, 12th Floor San Francisco, CA 94105 Email: [hello@truevault.com](mailto:hello@truevault.com) 2024 © All Rights Reserved.  [Privacy Policy](https://privacy.truevault.com/privacy-policy)  |  [Terms of Use](https://www.truevault.com/legal/truevault-terms-of-use)  |  [Supplemental Terms](https://www.truevault.com/legal/truevault-supplemental-terms-of-use) | [California Privacy Notice](https://privacy.truevault.com/privacy-policy#california-privacy-notice)