Disable TLS_RSA_* cipher suites on port 4444
Details
| Detail name | Value |
|---|---|
| Changelog Number | 23182 |
| Type | Improvement |
| Status | Resolved |
| Fix Versions | Exasol 8.33.0, Exasol 8.29.10 |
| Resolution Date | 2025-02-27 |
Background
Cipher suites are standardized sets of algorithms used for encrypted network connections. When establishing a connection, a cipher suite supported by both client and server is negotiated. The set of supported cipher suites depends on the software in use, but also on security considerations, which can change over time as novel attacks become known.
The cipher suites whose name begins with TLS_RSA_ are known to be vulnerable to the so-called ROBOT attack. Most of our services have already stopped using this cipher suite, forcing clients to use more secure alternatives, but there was a service left listening on port 4444 that still accepted the TLS_RSA_* cipher suites.
Improvement
No TLS_RSA_* cipher suites are supported on port 4444 anymore. All non-ancient client software should support alternative cipher suites, so no action is necessary on the customer side (except that any exceptions that may have been added to security scanners, if applicable, for this vulnerability can be removed now).
