Question About PA SSL vulnerability

[Sethupathi]

Hello Team,

Can anyone provide a solution resolve below vulnerability in PA.

Port no.: 443

Summary: Weak cipher suites supported

Analysis :The remote host running SSL using a weak cipher suite which can be exploited by an attacker to perform man in the middle attacks. All the updated and secured services will be transmitting data over the unencrypted channel.

Attacker can obtain the keys with factorization in short amount of time. Also vulnerable to various cryptographic flaws like POODLE attack or MITM attack.

Recommendations: Remove the weak or guessable cipher suites

Could you please help us here to fix an issue.

Note: PAN-OS 8.0. Platform

Regards,

Sethupathi M

[fjwcash · Accepted solution]

Is this when accessing the web UI for managing the firewall?  If so, it's an easy fix:

  - Device tab --> Certificate Management --> SSL/TLS Service Profile

  - click on the profile that you use for the web interface (as specified under Device tab --> Setup --> Management sub-tab)

  - change the Min Version to TLSv1.2

  - click OK

  - commit the change

Run the vulnerability scanner again, and it shouldn't show up anymore.

If this is for something else, you'll need to provide more details.