CIMC reporting to our Tenable scanner that it is vulnerablity

silviomanziano — Wed, 01 May 2024 17:30:59 GMT

We have CIMC reporting to our Tenable scanner that it is vulnerablity to Terrapin Vulnerability. see below :

./Terrapin-Scanner Report Remote Banner: SSH-2.0-OpenSSH_8.8 PKIX[13.2.3]

ChaCha20-Poly1305 support: true
CBC-EtM support: false
Strict key exchange support: false
The scanned peer is VULNERABLE to Terrapin.

I am trying to understand how to view\change the ciphers we are using so they are not vulnerable any longer. Here is what I am seeing is currently enabled.

servername /cimc/tls-config # show detail
TLS Configuration:
TLS Static Cipher Enabled: NA
Configured TLS Version: TLSv1.2, TLSv1.3
TLS Version 1.2 Enabled: yes
TLS Version 1.2 Cipher Mode: High
TLS Version 1.2 Cipher List: ALL:!DH:!EDH:!ADH:!EXP:!EXPORT40:!EXPORT56:!LOW:!MEDIUM:!RC4:!3DES:!SSLv2:!eNULL:!aNULL:!PSK:!SRP:!RSA:+HIGH
TLS Version 1.2 Custom Status: NA
TLS Version 1.3 Cipher Suite: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256

topic CIMC reporting to our Tenable scanner that it is vulnerablity in Network Security

CIMC reporting to our Tenable scanner that it is vulnerablity