Information

A CVE-2014-3566 vulnerability in SSLv3 protocol was identified by the Google security team. There is an additional whitepaper available from OpenSSL that also describes this vulnerability.

You can check if your website is vulnerable with curl:

curl -v3 -X HEAD https://www.example.com

If you are NOT vulnerable, your output should look something like this:

curl: (35) SSL connect error

If you ARE vulnerable, you will see normal connection outputs, potentially including the line:

SSL 3.0 connection using ...

Resolution

Although the possibility to exploit this vulnerability is quite low, the simplest way is to disable SSL 3.0 - this obsoleted protocol version is being used for compatibility needs and is not required for Parallels products.

For specific Parallels products, here is the list of articles which you may refer to:

Internal content

Link on internal Article