漏洞介绍https://www.openssl.org/~bodo/ssl-poodle.pdf
强制sslv3.0会是的BEAST攻击变得很容易，v3.0不是一个安全的协议版本。
规避：
禁用ssl v3.0
F5：
-如果ssl卸载在F5上，那么ssl profile中可以设置关闭ssl v3.0 （BIGIP v11.5以后版本默认已弃用ssl3.0 因此不受影响）
*如果你的用户还很多使用sslv3.0的话，请谨慎。具体可以通过命令查看profile的统计中sslv3.0使用占比情况。
-F5的管理接口，可通过命令设置关闭ssl v3.0。或禁止非授权网络访问。
| Product | Versions known to be vulnerable | Versions known to be not vulnerable | Vulnerable component or feature |
| BIG-IP LTM | 11.0.0 - 11.4.1 10.0.0 - 10.2.4 |
11.5.0 - 11.6.0 | SSL profiles |
| 11.0.0 - 11.6.0 10.0.0 - 10.2.4 |
None | Configuration utility | |
| BIG-IP AAM | 11.4.0 - 11.4.1 | 11.5.0 - 11.6.0 | SSL profiles |
| 11.4.0 - 11.6.0 | None | Configuration utility | |
| BIG-IP AFM | 11.3.0 - 11.4.1 | 11.5.0 - 11.6.0 | SSL profiles |
| 11.3.0 - 11.6.0 | None | Configuration utility | |
| BIG-IP Analytics | 11.0.0 - 11.4.1 | 11.5.0 - 11.6.0 | SSL profiles |
| 11.0.0 - 11.6.0 | None | Configuration utility | |
| BIG-IP APM | 11.0.0 - 11.4.1 10.1.0 - 10.2.4 |
11.5.0 - 11.6.0 | SSL profiles |
| 11.0.0 - 11.6.0 10.1.0 - 10.2.4 |
None | Configuration utility | |
| BIG-IP ASM | 11.0.0 - 11.4.1 10.0.0 - 10.2.4 |
11.5.0 - 11.6.0 | SSL profiles |
| 11.0.0 - 11.6.0 10.0.0 - 10.2.4 |
None | Configuration utility | |
| BIG-IP Edge Gateway | 11.0.0 - 11.3.0 10.1.0 - 10.2.4 |
None | SSL profiles Configuration utility |
| BIG-IP Link Controller | 11.0.0 - 11.6.0 10.0.0 - 10.2.4 |
None | Configuration utility |
| 11.3.0 - 11.6.0 | None | Configuration utility | |
| BIG-IP PSM | 11.0.0 - 11.4.1 10.0.0 - 10.2.4 |
None | SSL profiles Configuration utility |
| BIG-IP WOM | 11.0.0 - 11.3.0 10.0.0 - 10.2.4 |
None | SSL profiles Configuration utility |
| Enterprise Manager | * | * | Configuration utility |
| FirePass | * | * | None |
| BIG-IQ Cloud | * |
* |
Configuration utility |
| BIG-IQ Device | * |
* |
Configuration utility |
| BIG-IQ Security | * |
* |
Configuration utility |
| BIG-IP GTM | 11.0.0 - 11.6.0 10.0.0 - 10.2.4 |
None | Configuration utility |
| BIG-IP PEM | 11.3.0 - 11.4.1 | 11.5.0 - 11.6.0 | SSL profiles |
| BIG-IP WebAccelerator | 11.0.0 - 11.3.0 10.0.0 - 10.2.4 |
None | SSL profiles Configuration utility |
| ARX | * | * | None |
参考文档：
https://support.f5.com/kb/en-us/solutions/public/15000/700/sol15702.html
To mitigate this vulnerability, you can disable SSLv3. To do so, refer to the following articles:
- SOL13171: Configuring the cipher strength for SSL profiles (11.x)
- SOL7815: Configuring the cipher strength for SSL profiles (9.x - 10.x)
- SOL13405: Restricting Configuration utility access to clients using high encryption SSL ciphers (11.x)
- SOL6768: Restricting Configuration utility access to clients using high encryption SSL ciphers (9.x - 10.x)
