It was possible to detect the usage of the deprecated TLSv1.0 and/or TLSv1.1 protocol on this system

漏洞描述：

It was possible to detect the usage of the deprecated TLSv1.0 and/or TLSv1.1 protocol on this system.

Medium 9001/tcp
Medium (CVSS: 4.3)
NVT: SSL/TLS: Deprecated TLSv1.0 and TLSv1.1 Protocol Detection
Summary
It was possible to detect the usage of the deprecated TLSv1.0 and/or TLSv1.1 protocol on this system.
Vulnerability Detection Result
In addition to TLSv1.2+ the service is also providing the deprecated TLSv1.0 and
,→ TLSv1.1 protocols and supports one or more ciphers. Those supported ciphers c
,→an be found in the 'SSL/TLS: Report Supported Cipher Suites' (OID: 1.3.6.1.4.1
,→.25623.1.0.802067) VT.
Impact
An attacker might be able to use the known cryptographic aws to eavesdrop the connection
between clients and the service to get access to sensitive data transferred within the secured
connection.
Furthermore newly uncovered vulnerabilities in this protocols won't receive security updates
anymore.
Solution:
Solution type: Mitigation
It is recommended to disable the deprecated TLSv1.0 and/or TLSv1.1 protocols in favor of the
TLSv1.2+ protocols. Please see the references for more information.
Aected Software/OS
All services providing an encrypted communication using the TLSv1.0 and/or TLSv1.1 protocols.
Vulnerability Insight
The TLSv1.0 and TLSv1.1 protocols contain known cryptographic aws like:
. . . continues on next page . . .
2 RESULTS PER HOST 5
. . . continued from previous page . . .
- CVE-2011-3389: Browser Exploit Against SSL/TLS (BEAST)
- CVE-2015-0204: Factoring Attack on RSA-EXPORT Keys Padding Oracle On Downgraded
Legacy Encryption (FREAK)
Vulnerability Detection Method
Check the used TLS protocols of the services provided by this system.
Details: SSL/TLS: Deprecated TLSv1.0 and TLSv1.1 Protocol Detection
OID:1.3.6.1.4.1.25623.1.0.117274
Version used: 2021-07-19T08:11:48Z
References
cve: CVE-2011-3389
cve: CVE-2015-0204

解决办法：禁用已弃用的TLSv1.0和/或TLSv1.1协议,以支持TLSv1.2+协议。

TLS发展历史：

协议	发布时间	状态
SSL 1.0	未公布	未公布
SSL 2.0	1995年	已于2011年弃用
SSL 3.0	1996年	已于2015年弃用
TLS 1.0	1999年	于2021年弃用
TLS 1.1	2006年	于2021年弃用
TLS 1.2	2008年
TLS 1.3	2018年

1、Nginx配置

如果conf/nginx.conf配置了ssl证书，且default_server的server域里面版本如下

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

则删除TLS1.0 TLSv1.1、增加TLS1.3

ssl_protocols TLSv1.2 TLSv1.3;

修改完后，执行./sbin/nginx -s reload重载生效。

2、Apache配置

修改/usr/local/apache/conf/extra/httpd-ssl.conf文件

vi /usr/local/apache/conf/extra/httpd-ssl.conf

可以看到版本还是SSLv3，修改为如下

SSLProtocol -ALL +TLSv1.2 +TLSv1.3
SSLProxyProtocol -ALL +TLSv1.2 +TLSv1.3

重启Apache

/usr/local/apache/bin/apachectl restart

It was possible to detect the usage of the deprecated TLSv1.0 and/or TLSv1.1 protocol on this system相关推荐

HDLBits 系列（14） Latch and Dff and Edge detect
目录 D Latch DFF + GATE Mux + DFF MUX2 + DFF FSM JK 触发器 Edgedetect(边沿检测) 双边沿检测 D Latch Implement the f ...
Pyinstaller将yolov5的detect.py封装成detect.exe，并用C++调用
Pyinstaller打包与c++调用 Pyinstaller打包 Pyinstall常用命令 Pyinstaller的踩坑记录 pyinstaller打包流程 C++调用 vs2019创建一个解决方 ...
Openpose Usage 笔记
代码说明 OpenPose - Github Windows model download http://posefs1.perception.cs.cmu.edu/OpenPose/models/p ...
ARM异常处理(3)：Bus faults、Memory management faults、Usage faults、Hard faults详解
之前介绍了了ARM异常处理(1):异常类型.优先级分组和异常向量表,里面有很多异常类型,其中有几个异常在错误处理中非常有用: 文章目录 1 Bus Fault 2 Memory Management ...
centos7上安装redis6-0-5
下载tar包 wget http://download.redis.io/releases/redis-6.0.5.tar.gz 解压tar包 tar -zxvf redis-6.0.5.tar.gz ...
004：STM32启动文件详解及SystemInit函数分析（转）
1 ;先在RAM中分配系统使用的栈,RAM的起始地址为0x2000_0000 2 ;然后在RAM中分配变量使用的堆 3 ;然后在CODE区(flash)分配中断向量表,flash的起始地址为0x080 ...
c++ char **argv 赋值
调用c++,有时不想输入参数,来个默认参数,解决方法 int main(int argc, char **argv) {//test_resize("data/bad.jpg"); ...
十八、redis.conf配置详解
启动的时候,就通过配置文件来启动! 工作中,一些小小的配置,可以突出专业性! [root@localhost rconfig]# more redis.conf 单位 # Redis configur ...
Android 6.0 Changes
Android 6.0 变化 Android 6.0 Changes In this document 执行时权限 Runtime Permissions Doze and App Standby ...

It was possible to detect the usage of the deprecated TLSv1.0 and/or TLSv1.1 protocol on this system

1、Nginx配置

2、Apache配置

It was possible to detect the usage of the deprecated TLSv1.0 and/or TLSv1.1 protocol on this system相关推荐

最新文章

热门文章