How to disable the SSLv3 protocol in Jetty to prevent Poodle Attack

Question

Is there any specific exclusion list available which disables only SSLv3 ciphers are not TLSv1/2.

I have jetty 8, and upgrading to 9 is not an option now. My current

Answer 1

To expand on @Lars answer ..

For Jetty 7, Jetty 8, and Jetty 9 you have to exclude the protocol SSLv3 (not the cipher) on any SslContextFactory you are using to configure for an SSL based Connector.

For a Jetty Distribution

Edit the ${jetty.home}/etc/jetty-ssl.xml and add the following XML snippet.

  
     SSLv3
  

Inside of any element that manages a org.eclipse.jetty.http.ssl.SslContextFactory

For Jetty Embedded

Any SslContextFactory you create/manage for your SSL based Connectors you just need to set the excluded protocols.

    SslContextFactory sslContextFactory = new SslContextFactory();
    sslContextFactory.addExcludeProtocols("SSLv3");
    sslContextFactory.setKeyStorePath(...);
    ...