I guess the gist of my question is: Are there cases in which CBC is better than GCM?
The reason I'm asking is that from reading this post by Matthew Green, and this question on cryptography stack exchange, and this explanation of an attack on XML (since I'm encrypting json in my work, although it's not streamed anywhere, but apparently a chosen cipertext attack is possible), then I should never, ever use CBC, and just use GCM.
In other words: There's no reason to use CBC, as long as GCM exists (which it does on OpenSSL, the library I use for my encryption work). Because:
GCM = CBC + Authentication.
Could someone please tell me whether my conclusions are correct?
IMPORTANT UPDATE: Since this question is getting popular so fast, I'd like to point out from my research that GCM IS NOT A SILVER BULLET. There's huge problem with GCM, which is that if you use the same IV twice it can compromise your key (due to the use of GMAC, so it's no fool-proof). In case you're paranoid (like myself), CBC with HMAC (encrypt then MAC) is probably the best if one wants to be on the safe side. (Also please correct me if I'm wrong on this update).