15

I just received an email from PayPal stating because of Poodle vulnerability they will discontinue support for SSLV3 using their payment API from 3rd of Dec 2014.

Just wanted to put it out there and ask if anyone knows if this will directly effect the PayPal Payment Pro / Hosted Solution / Express payments integration in Magento 1.9.0.1 (latest)?

If so - anyone have an idea how I can go about fixing the standard paypal modules in magento?

Thanks!

Improve this question
2
  • There are already several threads about this over at Stack Overflow. Essentially, you just need to connect to PayPal's API via TLS using cURL - however that transpires.
    – benmarks
    Nov 12, 2014 at 3:03
  • Hi Benmarks.. I did do a search on this but not really on the stack overflow site, just the magento part. I've just tried looking for those threads to see if I can do more testing but can't seem to find them, could you please pass me some links? Thanks!
    – loginid
    Nov 12, 2014 at 4:25

7 Answers 7

Reset to default
2

As I understand it (and please correct me if I'm wrong) that it is in fact your hosting company (if on a shared platform) or you yourself if on VPS or Dedicated server for example that would have to disable the SSLv3. Your web host should do this, if they haven't already, and if you are responsible for your own server then I believe you can modify your httpd.conf and add the following;

SSLProtocol ALL -SSLv2 -SSLv3

This will disable v2 and v3 and I believe that TLS is the standard fallback connection.

This is if Apache config so if you are using something else, then the code may change slightly, but hopefully this helps you a little but I would be grateful to hear other peoples input on this too.

Improve this answer
6
  • For your information, you can test to see if your web server currently has SSLv2 or SSLv3 enabled using this site foundeo.com/products/iis-weak-ssl-ciphers/test.cfm
    – Tony Pollard
    Nov 12, 2014 at 2:07
  • ahuh! Thanks for that Tony - I think that makes sense to me now. So it's nothing to do with the way that Magento is coded at all but has everything to do with the way the hosting company has configured which SSL (or not using SSL now) is used.
    – loginid
    Nov 12, 2014 at 4:24
  • Tony, you've got it back to front. You have mentioned server side SSLv3 for inbound requests, not server initiated outbound requests. The PayPal email relates to the latter.
    – choco-loo
    Nov 12, 2014 at 8:50
  • Yeah pretty much loginid, symantec have also released a checking tool. I carried out the change I described above on a VPS I have and its pasdsed both checks now so I shouldnt have any issues.
    – Tony Pollard
    Nov 12, 2014 at 19:26
  • choco-loo, if my server initiates an outbound request, but doesnt have SSLv3 enabled, then it cant use it correct? Also browsers and the payment gateways are ceasing support for SSLv3 too, so doesnt this stop it all ways round? I dont believe Magento even uses a particular protocol anyway, but I'm trying to make sure that everything is safe. Be interested to know your thoughts if you have time.
    – Tony Pollard
    Nov 12, 2014 at 19:29
1

Drop this code:

<html>
<head>
</head>
<body>
<?php
$url = "ssl://www.sandbox.paypal.com";
$fp = fsockopen ($url, 443);
if (is_resource ($fp)) {
    echo "not affected";
}
else {
    echo "affected";
}
?>
</body>
</html>

in a file named paypal-tls-test.php in the root of your Magento site. Then point your browser to it like http://www.yoursite.com/paypal-tls-test.php. The script tries to make a connection to the PayPal sandbox which no longer supports SSLv3. If it makes a successful connection then it's a good indication you'll be ok. If not, you have work to do. This of course assumes that the actual protocol is not hard-coded in Magento somewhere (the script checks your server's ability to make the connection.)

Improve this answer
1
  • This script tells me "not affected" while poodlescan.com says "This server supports the SSL v3 protocol." => VULNERABLE.
    – PiTheNumber
    Nov 25, 2014 at 13:10
0

Its all in the CURL connect. What you need to check is that your servers client-side curl library supports TLS (so that it can fallback).

Make a simple PHP CURL script with the following definition to force TLS,

curl_setopt($curl_request, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1);

If successful, you have nothing to worry about. If not, you'll likely need a recompile of libcurl and openssl

Improve this answer
0

As far as I can tell, on my client's ancient Magento 1.4.1.1 setup, the core Paypal communications (via curl) do not force any particular protocol, so curl should use TLS when Paypal drop support for SSLv3.

I guess I'll find out for sure on 3rd December.

Improve this answer
1
  • It should be using TLS now already, BUT, it's vulnerable to the MITM forcing it to rollback from TLS to SSLv3, which is broken... On 12/3, the server side will refuse to rollback to SSL. IF at all possible you want to fix your client side to not allow rollback now to provide protection until Paypal finally fixes their side.
    – Brian Knoblauch
    Nov 21, 2014 at 17:01
0

I added the following line:

curl_setopt($curl_request, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1);

into a test php script. An this is the result after executing it via a browser:

curl_setopt($curl_request, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1);

is this ok? Could I work with my curl 7.33.0 version and paypal also after th 3rd of december? I guess yes!

Regards JJ

Improve this answer
0

So my paypal account manager calls me up today and tells me that my websites are using ssl 3.0 / poodle and will not work after the migration on Dec.3

They point me at all these documents that basically say that if I can make a call to the development sandbox server and receive an acceptable response then everything should be ok.

I've changed absolutely nothing in code nor the server config. I tested on the development sandbox server and everything goes through perfectly fine. Magento ver. 1.4.1.0

Does this mean everything should be OK come Dec.3?

Note, all my websites still giving me the below messages when running through https://www.poodlescan.com/

"This server supports the SSL v3 protocol." "This server supports the SSL v2 protocol. You should really disable this protocol."

Any help would be greatly appreciated.

Improve this answer
1
  • This means that your site is already able to do TLS, but is vulnerable to a man in the middle attack which forces you down to SSL and then cracks the data stream. Your stuff won't break when the other side is upgraded, but you're also not secure.
    – Brian Knoblauch
    Nov 21, 2014 at 18:23
0

Edit you Apache's httpd.conf and add the following code:

SSLHonorCipherOrder On
SSLProtocol -All +TLSv1

You may also do this via WHM if you have a VPS or Dedicated Server:

Go to Service Configuration -> Apache Configuration -> Include Editor -> Pre Main Include

and add the above two lines.

Then you may connect to PayPal sandbox to test you SSLv3 has been disabled, or you may add the code Randall Hertzler suggested in his answer.

I've done the above myself and it works fine.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.