PayPal Transport Layer Security (TLS) - SSL 3.0 vulnerability

[[email protected]]

Did anyone get this message from PayPal that they are discontining support of SSL 3.0 on Dec 03, 2014?
Consequently, PayPal Payment module will probably stop working. So does anyone know if the upgrade to Transport Layer Security (TLS) must from Miva or website hosting provider/ISP?

Below is text of email from PayPal
--------------------------------
Immediate Action Required
Dear Jeff Young,
On Tuesday, October 14, 2014, details were released about a vulnerability to version 3 of Secure Sockets Layer (SSL 3.0). Since that time, PayPal has been hard at work to mitigate any potential impact to our consumers and merchant customers.

To help mitigate risk associated with this vulnerability, PayPal will discontinue support for SSL 3.0 on December 3, 2014 at 12:01 a.m. Pacific Standard Time. Unfortunately, this necessary step may cause compatibility problems resulting in the inability for customers to pay with PayPal on your site or other processing issues.

We wouldn’t have been able to extend our support of SSL 3.0 to December 3, 2014, at 12:01 a.m. PST if we hadn’t also been able to take significant steps to migrate the risk of this vulnerability for our customers. We want to assure our customers we have seen no evidence that the SSL 3.0 issue has led to any compromise of security at PayPal.

Keeping our customers’ accounts, data and money secure is PayPal’s top priority and a guiding principle when we make challenging decisions, like this one.

We’re here to help our merchants through this process. We’ve put together a comprehensive Merchant Response Guide to ensure systems are secure from this vulnerability.

What do I need to do?

If you don’t manage website integrations for your business, we strongly encourage you to work with your website service partner (developer, hosting company or e-commerce platform, etc.) and share the Merchant Response Guide, which provides the basic guidelines on how to update to Transport Layer Security (TLS). If your website service has questions or need support, advise them to contact our Merchant Technical Support.

Thank you for your prompt attention to move this issue and understanding of our approach. Though we recognize this necessary step may cause compatibility issues, we can’t stress enough that this short-term inconvenience is heavily outweighed by our joint promise to our respective customers that we will keep their accounts and financial details safe. We plan to keep our customers up to date on how we are addressing this issue via the appropriate channels, including PayPal Forward, our Twitter handle, Customer Service and for merchants, through our Merchant Services team.

For technical assistance, please call 855-489-0342, for quicker routing please contact from a phone number on your PayPal Account. They are available Monday thru Friday from 8:00am to 6:00pm CST.

We appreciate your patience and understanding as we work around the clock to better serve you and keep you and our consumers safe.

Sincerely,
Colin Masilko
Business Consultant – Merchant Services
Mon-Fri 9:00am - 5:30pm CST
[IMG]imap://youngj211%[email protected]:143/fetch%3EUID%3E.INBOX%3E210779?part=1.2&filename=im age001.png[/IMG]
7700 Eastport Parkway
LaVista, NE 68128
PayPal.com

Please do not reply to this email. We are unable to respond to inquiries sent to this address. For immediate answers to your questions, visit our help center by clicking Help on any PayPal page.
© 2014 PayPal, Inc. All rights reserved. PayPal is located at 2211 N. First St., San Jose, CA 95131.

[ILoveHostasaurus]

Re: PayPal Transport Layer Security (TLS) - SSL 3.0 vulnerability

As long as your store is running on engine version 5.17 or above, it will not be affected. Older versions will not be able to communicate with them.

[[email protected]]

Re: PayPal Transport Layer Security (TLS) - SSL 3.0 vulnerability

Thanks, David. I have Miva Merchant Engine v5.16? Can you direct me to instructions for upgrading to v5.17 for my ISP? or can I purchase upgrade services from Miva?

[ILoveHostasaurus]

Re: PayPal Transport Layer Security (TLS) - SSL 3.0 vulnerability

Empresa can be downloaded from: http://www.miva.com/support/downloads

In most cases, upgrading is just a few steps:

1) Copy the mivavm binary over top of the old one (or, rename, and replace so you can easily back out)
2) Replace the libmivavm.so with the lib/config/ file that is relevant; one is env.so, the other is 3x.so
3) Point it at the new 'builtins' directory of libraries or rename the old one and put the new one in its place.

If you have a dedicated server or otherwise have root access, and are not hosted with us, we do offer an upgrade service that can be purchased.