topic Diffie-Hellman Ephemeral Key Exchange DoS Vulnerability (SSL/TLS, D(HE)ater) in GlobalProtect Discussions

Diffie-Hellman Ephemeral Key Exchange DoS Vulnerability (SSL/TLS, D(HE)ater)

Per_Edner — Tue, 05 Sep 2023 09:01:46 GMT

Hi, Has anyone running the client version of GP successfully mittigated the Diffie-Hellman Ephemeral Key Exchange DoS Vulnerability (SSL/TLS, D(HE)ater) for the GP portals? I have only found ways to disable DHE for clientless GP configuration.

We are running PANOS 10.1.10 h1 but it seems like DHE is supported on all PANOS version even though it is not recommended to use them.

Re: Diffie-Hellman Ephemeral Key Exchange DoS Vulnerability (SSL/TLS, D(HE)ater)

kiwi — Wed, 06 Sep 2023 11:29:26 GMT

Hi @Per_Edner ,

I believe the following KB explains how to disable DHE key algorithm:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004MCcCAM

Kind regards,

-Kim.