ariya/phantomjs — pull request #12663 by markstos (2014-10-18 00:17:10+00:00)
Title: Change default ssl protocol to TLSv1 in the 1.9.x branch to address POODLE

SSLv3 is vulnerable to man-in-middle attacks as discovered in POODLE. Servers and clients are encouraged to use TLSv1 instead.

PhantomJS already supports bothh protocols, but the vulnerable SSLv3 is currently the default.

Here's a patch to change the default to TLSv1 instead. I've also included a second to help prepare the 1.9.8 release, if that's of interest. If not, the basic update can cherry-picked or copy/pasted as a diff easily enough.

The proposed ChangeLog entry provided explains the change a bit and tells people how to get the old behavior in case they want or need it.