topic Re: SSL and TLS vulnerabilities in Next-Generation Firewall Discussions

SSL and TLS vulnerabilities

Senibo — Tue, 30 Jan 2024 15:34:43 GMT

Hi Team,

We have to 2 Paloalto VM firewall running active-passive mode in AWS.

As a part of internal Pentest we go the below findings for the Active and passive firewall nodes. The result refers to SSL and TLS vulnerabilities.

Could you please suggest on how to mitigate this.

Re: SSL and TLS vulnerabilities

Claw4609 — Wed, 31 Jan 2024 20:32:11 GMT

What is the specific vulnerability that is being flagged? My first thought is that you dont have a SSL/TLS Service profile attached to the managment interface or enforcing a minimum of tls 1.2.

Add a certificate to a SSL/TLS Service profile and enforcing tls v1.2: Configure an SSL/TLS Service Profile (paloaltonetworks.com)

Adding that SSL/TLS service profile to the management interface: Device > Setup > Management (paloaltonetworks.com)

Re: SSL and TLS vulnerabilities

Senibo — Thu, 08 Feb 2024 15:39:49 GMT

Hi,

These are the Vuln that are being flagged ==-> 1. 38913 SSH Prefix Truncation Vulnerability (Terrapin)
2. 38909 SHA1 deprecated setting for SSH

Re: SSL and TLS vulnerabilities

Claw4609 — Thu, 08 Feb 2024 15:50:19 GMT

Gotcha, then in that case I believe you are needed to create an SSH service profile and attach it. Depending on what you're all needing to be removed you may also need to follow the KB article attached.

Configure an SSH Service Profile (paloaltonetworks.com)

How to fix Weak Ciphers and Keys on the Management Interface fo... - Knowledge Base - Palo Alto Networks