For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Moinul_Rony's avatar
Moinul_Rony
Icon for Altostratus rankAltostratus
Jan 07, 2015

Removing Poodle TLS padding vulnerability returns RC4 warning

Hi,   We are running F5 LTM version 11.2. Recently we disabled the RC4 weak CIPHER to remove the Minimal warning from our PCI scan.   But due to the recent arrival of Poodle TLS vulnarability ...
application delivery
LTM
amolari's avatar
amolari
Icon for Cirrostratus rankCirrostratus
Jan 07, 2015

Hi

 

the F5 solution 15882 states "To mitigate this vulnerability, you can create a custom cipher string for the SSL profile that uses RC4 or AES-GCM ciphers"

 

AES-GCM is not supported in pre 11.5.0 releases.

 

I think here you should upgrade (11.2.1 HF13 is the closest to your release, with TLS poodle fixed)

 

Alex