Clarification: CBC based ciphers are found as weak in Testssl tool for tls 1.2v in Windows server 2019.

Question

Clarification: CBC based ciphers are found as weak in Testssl tool for tls 1.2v in Windows server 2019.

Raja Phanendra 0

In Windows server 2019, Testssl tool found CBC based ciphersuites are weak. Are CBC based cipher suites are prone to vulnerable even if they are managed by Windows Schannel. Found an article stating that, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 and TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 may show up as weak when you performed an SSL report test. This is due to known attacks toward OpenSSL implementation. Dataverse uses Windows implementation that is not based on OpenSSL and therefore is not vulnerable. https://learn.microsoft.com/en-us/power-platform/admin/server-cipher-tls-requirements

Please provide the clarification for the above, whether the same is applicable to all the CBC based ciphersuites or not?

Alex Burlachenko 2,680 Reputation points

2025-02-25T08:58:59.1933333+00:00

today I seen the same Q and already answer to that https://learn.microsoft.com/en-us/answers/questions/2182158/is-tls-1-2-cbc-based-cipher-suites-are-vulnerable pleas take a look my answer there.

rgds,

Alex

Your answer

Alex Burlachenko 2,680 Reputation points

2025-02-25T08:58:59.1933333+00:00

today I seen the same Q and already answer to that https://learn.microsoft.com/en-us/answers/questions/2182158/is-tls-1-2-cbc-based-cipher-suites-are-vulnerable pleas take a look my answer there.

rgds,

Alex

Share via

Clarification: CBC based ciphers are found as weak in Testssl tool for tls 1.2v in Windows server 2019.

Your answer