Insecure TLS versions on designsystem.eclipse-foundation.org

From the security ML:

Summary

The server at designsystem.eclipse-foundation.org is configured to support the TLS 1.0 protocol with the cipher suite TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA. This combination is considered weak due to vulnerabilities in both the protocol and the cipher suite.

---

Technical Details

• TLS Version: TLS 1.0
• Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA

TLS 1.0 is deprecated and vulnerable to attacks like BEAST. The use of AES in CBC mode is susceptible to padding oracle attacks, and SHA-1 is considered weak and has been deprecated in favor of SHA-256 or stronger hash functions.

---

Risks

• Security Vulnerabilities: Increased risk of data breaches and unauthorized access due to weak encryption.
• Compliance Issues: Potential violations of industry standards and regulations requiring strong encryption.
• Performance Concerns: Possible service interruptions or degraded performance due to the use of outdated protocols and cipher suites.

---

Recommendations

1. Upgrade to TLS 1.2 or Higher: Configure the server to support at least TLS 1.2, as it offers stronger security features and is widely supported.
2. Disable TLS 1.0 and 1.1: Disable support for TLS 1.0 and 1.1 on the server to prevent their use.
3. Configure Strong Cipher Suites: Implement strong cipher suites such as:
   • TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
   • TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
4. Regularly Review and Update Security Configurations: Periodically audit and update SSL/TLS configurations to align with current security best practices and compliance requirements.

---

Steps to Reproduce

To verify the supported cipher suites for the domain, you can use the following OpenSSL command:

openssl s_client -connect designsystem.eclipse-foundation.org:443 -cipher 'ALL:eNULL' -showcerts

This command will display the certificate and the supported cipher suites. Look for the presence of TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA and the use of TLS 1.0.