Forum Discussion

Moinul_Rony's avatar
Moinul_Rony
Icon for Altostratus rankAltostratus
Jan 08, 2015

Removing Poodle TLS padding vulnerability returns RC4 warning

Hi,   We are running F5 LTM version 11.2. Recently we disabled the RC4 weak CIPHER to remove the Minimal warning from our PCI scan.   But due to the recent arrival of Poodle TLS vulnarability ...
application delivery
LTM
boneyard's avatar
boneyard
Icon for MVP rankMVP
Jan 08, 2015

Alex is correct, the solution for POODLE TLS and some other attacks is to enable only RC4. but on the other side RC4 is considered unsafe itself and will probably to publicly announced to be disabled at some time in future.

 

so the best fix for POODLE TLS remains the hotfix version.