Disable CBC cipher suites on port 4444
Details
| Detail name | Value |
|---|---|
| Changelog Number | 25398 |
| Type | Improvement |
| Status | Resolved |
| Fix Versions | Exasol 2025.1.0, Exasol 8.29.11 |
| Resolution Date | 2025-07-08 |
Background
Cipher suites are standardized sets of algorithms used for encrypted network connections. When establishing a connection, a cipher suite supported by both client and server is negotiated. The set of supported cipher suites depends on the software in use, but also on security considerations, which can change over time as novel attacks become known.
The cipher suites using 64-bit block ciphers in CBC mode are known to be vulnerable to the so-called SWEET32 attack (see sweet32.info).
Most of our services have already stopped using this cipher suite, forcing clients to use more secure alternatives, but there was a service left listening on port 4444 that still accepted the CBC cipher suites.
Improvement
No CBC cipher suites are supported on port 4444 anymore. All non-ancient client software should support alternative cipher suites, so no action is necessary on the customer side (except that any exceptions that may have been added to security scanners, if applicable, for this vulnerability can be removed now).
