For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

scogran's avatar
scogran
Icon for Nimbostratus rankNimbostratus
Mar 19, 2015

OpenSSL and management console

I am running 11.4.1 HF8. The management console is still using OpenSSL 0.9.8y, which our internal security scanner doesn't like. Is there a patch that I missed, or is that the current supported version? I can always argue that it's internal and can therefore ignore the vulnerability, but I'd like to make it go away if I can.

 

Thanks for any help.

 

management
security

2 Replies

  • Kharsma_176894's avatar
    Kharsma_176894
    Icon for Nimbostratus rankNimbostratus
    Mar 20, 2015

    I believe hat is the current standard for 11.4.x code, starting in the 11.5.x code they updated OpenSSL to OpenSSL 1.0.1e-fips. What vulnerabilities are you getting from your scan? Also, F5 only uses the OpenSSL (COMPAT) stack on the management port, and https monitors(I'm not 100% on this), unless you've changed your cipher-text on the SSL profiles from 'DEFAULT'.

     

  • scogran's avatar
    scogran
    Icon for Nimbostratus rankNimbostratus
    Mar 20, 2015

    Ya, the virtual servers are fine. No issues there. This only affects the management console. It shows up as "multiple openSSL vulnerabilities" as 0.9.8.y is 2 years old and 0.9.8.za fixed a lot of stuff last year. Once we finish removing SSLv3 from our environment, I can upgrade to 11.5 or 11.6, which appears to use a newer version.