Restricted allowed TLS Ciphers
Details
| Detail name | Value |
|---|---|
| Changelog Number | 18764 |
| Type | Improvement |
| Status | Resolved |
| Fix Versions | Exasol 8.25.0, Exasol 7.1.26 |
| Resolution Date | 2024-02-15 |
Improvement
The allowed TLS ciphers and cipher suites has been restricted to the following list:
- TLS_AES_128_GCM_SHA256
- TLS_AES_256_GCM_SHA384
- TLS_CHACHA20_POLY1305_SHA256
- ECDHE-ECDSA-AES128-GCM-SHA256
- ECDHE-RSA-AES128-GCM-SHA256
- ECDHE-ECDSA-AES256-GCM-SHA384
- ECDHE-RSA-AES256-GCM-SHA384
- ECDHE-ECDSA-CHACHA20-POLY1305
- ECDHE-RSA-CHACHA20-POLY1305
- DHE-RSA-AES128-GCM-SHA256
- DHE-RSA-AES256-GCM-SHA384
- DHE-RSA-CHACHA20-POLY1305
This list aligns with Mozilla’s recommended intermediate level of compatibility (https://wiki.mozilla.org/Security/Server_Side_TLS ).
This change affects the following services:
- bucketfs' https endpoint.
- confd’s https endpoint (its xmlrpc endpoint).
- virtserverd’s ftps and https endpoints (which allow access to local archive volumes over those protocols).
Changed behavior
The compatibility of browsers (and any client) to access those services over the specified protocols has been narrowed. The recommendations page (https://wiki.mozilla.org/Security/Server_Side_TLS) has a list of compatible browser versions. It is expected that any client released in the last 5 years or so will be compatible. It is recommended to check compatibility before updating if you are still using older clients (like those available on Windows XP).
