Forum Discussion

Stefan_Klotz's avatar
Stefan_Klotz
Icon for Cumulonimbus rankCumulonimbus
Oct 07, 2013

Update openssl version separately???

Hi there, I'd like to ask you this time if there is any possibility to update the openssl version without updating the TMOS. Right now the affected boxes are running 10.1.0 HF2 with openssl 0.9.8e, b...
management
security
What_Lies_Bene1's avatar
What_Lies_Bene1
Icon for Cirrostratus rankCirrostratus
Oct 10, 2013

Well, it doesn't fix OpenSSL, but it avoids it and thus mitigates the risk. The cipher string to use to avoid using compat ciphers (and thus OpenSSL) for your version would be: 

!SSLv2:ALL:!DH:!ADH:!EDH:!MD5:!EXPORT:!DES:@SPEED
.

Note when you move to v10.2 or later, you no longer need to do this, the default ciphers only include native ciphers.