topic Re: Weak SSL/TLS Key Exchange in Network Security

Weak SSL/TLS Key Exchange

mohammedalrawiib — Mon, 22 Apr 2024 05:58:45 GMT

I hope your doing well

in our network infrastructure where we have Qualys to scan for vulnerabilities i can't find a solution for this certain vulnerability here are the details :

Weak SSL/TLS Key Exchange

impact an attacker with access to sufficient computational power might be able to recover the session key and decrypt session content

i have tried the suggested solution from both community cisco but when we i scan again the vulnerability remains the same , the solution that i have tried is to disable SSL/TLS on the switches after scanning it still shows the same vulnerability ,also i have tried to configure the cipher suite with AES 256 the vulnerability remains the same .

the following commands were executed

no ip http secure-server

the switch we have is cisco 9200 version 17.6

regards

Re: Weak SSL/TLS Key Exchange

Kumaresan Ravichandran — Mon, 22 Apr 2024 06:26:24 GMT

Hello @mohammedalrawiib

Configuration changes might require a reboot to take effect. Reboot the switch and re-scan to verify if the vulnerability persists.

Determine if there are other interfaces or modules on the switch that might be using SSL/TLS.

will you share the output of "show running-config".

>_<

Re: Weak SSL/TLS Key Exchange

mohammedalrawiib — Mon, 22 Apr 2024 08:39:09 GMT

hello

i can't reboot this will take our service down , i tried to enable it again they said it would remove it this is the config

ip forward-protocol nd
no ip http server
ip http authentication local
no ip http secure-server
ip http secure-ciphersuite aes-256-cbc-sha
ip http tls-version TLSv1.2

Re: Weak SSL/TLS Key Exchange

Kumaresan Ravichandran — Mon, 22 Apr 2024 12:33:07 GMT

Hello @mohammedalrawiib

When dealing with SSL/TLS vulnerabilities, particularly those related to key exchange, it can be frustrating when the recommended solutions don't seem to resolve the issue. If your goal is to mitigate the "Weak SSL/TLS Key Exchange" vulnerability, these commands can help ensure secure configurations. Then it is resolved right ?

I hope this helps resolve your vulnerability issue. If it is ok then mark your post to solved category.

Rate it too.

>_<

Re: Weak SSL/TLS Key Exchange

Marvin Rhoads — Mon, 22 Apr 2024 13:35:24 GMT

@mohammedalrawiib you asked this question is a separate thread last week: https://community.cisco.com/t5/network-security/weak-ssl-tls-key-exchange/td-p/5072776

At that time you said you were going to provide the running config but you have not yet done so.

Re: Weak SSL/TLS Key Exchange

mohammedalrawiib — Tue, 28 May 2024 12:53:35 GMT

Dears

after a while we changed the ssh port number (default is 22) to another port also we blocked 22 port then the vulnerability was removed this is the solution that we found if you have any other solution please let us know.

best regards