Weak Ciphers - Failing Scan PCI Compliance

[ianbevis]

I have the same problem, scan failing with WEAK Ciphers.

The setup is as follows:-

APACHE

ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256

all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1



-----

cPanel Web Services Configuration

ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384

SSLv23:!SSLv2:!SSLv3:!TLSv1:!TLSv1_1

----

EXIM

+no_sslv2 +no_sslv3 +no_tlsv1 +no_tlsv1_1

EECDH+AESGCM:EDH+AESGCM

DEFAULT was

ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384

--------

FTP Server Configuration

HIGH:MEDIUM:+TLSv1:!SSLv2:+SSLv3
SSLv23



----------------------

The issues I have from the scan:-

Diffie-Hellman Ephemeral Key Exchange DoS Vulnerability (SSL/TLS, D(HE)ater)
The remote SSL/TLS server is supporting Diffie-Hellman ephemeral (DHE) Key Exchange
algorithms and thus could be prone to a denial of service (DoS) vulnerability.

Technical Details
'DHE' cipher suites accepted by this service via the TLSv1.2 protocol:
TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA TLS_DHE_RSA_WITH_AES_128_CBC_SHA TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 TLS_DHE_RSA_WITH_AES_128_CCM
TLS_DHE_RSA_WITH_AES_128_CCM_8 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 TLS_DHE_RSA_WITH_AES_256_CCM TLS_DHE_RSA_WITH_AES_256_CCM_8 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256 TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384 TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256
TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 TLS_DHE_RSA_WITH_SEED_CBC_SHA

CVEs
This vulnerability covers the following CVEs:
• CVE-2002-20001
• CVE-2022-40735

----

SSL/TLS: Report Weak Cipher Suites
This routine reports all Weak SSL/TLS cipher suites accepted by a service.
NOTE: No severity for SMTP services with 'Opportunistic TLS' and weak cipher suites on port
25/tcp is reported. If too strong cipher suites are configured for this service the alternative
would be to fall back to an even more insecure cleartext communication.

Technical Details
'Weak' cipher suites accepted by this service via the TLSv1.2 protocol:
TLS_RSA_WITH_SEED_CBC_SHA

----

OpenBSD OpenSSH Multiple Important Vulnerabilities
According to its self reported version number, the version of OpenBSD OpenSSH installed on the
remote host is out of date and known to be affected by multiple vulnerabilities

 

[cPRex]

Hey there! The OpenSSH warning is likely false due to the backporting updating process. You can read more about that here:

PCI Compliance and Software Versions | cPanel & WHM Documentation

This document discusses some of the specific software packages that contain known vulnerabilities. This document will also help you determine whether developers used the backport process to patch a software package.

docs.cpanel.net

As far as the other issues, you would need to modify the cipher list for the service (WHM >> Apache Configuration >> Global Configuration) in order to only list the necessary ciphers to pass the security test.