For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Moinul_Rony's avatar
Moinul_Rony
Icon for Altostratus rankAltostratus
Jan 07, 2015

Removing Poodle TLS padding vulnerability returns RC4 warning

Hi,   We are running F5 LTM version 11.2. Recently we disabled the RC4 weak CIPHER to remove the Minimal warning from our PCI scan.   But due to the recent arrival of Poodle TLS vulnarability ...
application delivery
LTM
boneyard's avatar
boneyard
Icon for MVP rankMVP
Jan 07, 2015

Alex is correct, the solution for POODLE TLS and some other attacks is to enable only RC4. but on the other side RC4 is considered unsafe itself and will probably to publicly announced to be disabled at some time in future.

 

so the best fix for POODLE TLS remains the hotfix version.