SSL and TLS vulnerabilities

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

SSL and TLS vulnerabilities

L1 Bithead

Hi Team,

We have to 2 Paloalto VM firewall running active-passive mode in AWS.

As a part of internal Pentest we go the below findings for the Active and passive firewall nodes. The result refers to SSL and TLS vulnerabilities.

Could you please suggest on how to mitigate this.


L4 Transporter

What is the specific vulnerability that is being flagged? My first thought is that you dont have a SSL/TLS Service profile attached to the managment interface or enforcing a minimum of tls 1.2.


Add a certificate to a SSL/TLS Service profile and enforcing tls v1.2: Configure an SSL/TLS Service Profile (

Adding that SSL/TLS service profile to the management interface: Device > Setup > Management (



These are the Vuln that are being flagged  ==->  1. 38913 SSH Prefix Truncation Vulnerability (Terrapin)
2. 38909 SHA1 deprecated setting for SSH

Gotcha, then in that case I believe you are needed to create an SSH service profile and attach it. Depending on what you're all needing to be removed you may also need to follow the KB article attached.


Configure an SSH Service Profile (


How to fix Weak Ciphers and Keys on the Management Interface fo... - Knowledge Base - Palo Alto Netw...

  • 3 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!