search

canonical / k8s-dqlite

Dqlite for Kubernetes
Apache License 2.0
33 stars 13 forks source link

SSL Medium Strength Cipher Suites Supported (SWEET32) on K8s dqlite #48

Open ryanwong00 opened 1 year ago

ryanwong00 commented 1 year ago

Hi all,

I am using a MicroK8s 1.27 cluster. We recently used Nexsus to do a security scan and it raised a medium threat for 'SSL Medium Strength Cipher Suites Supported (SWEET32)' on port 19001. Is there any way to define the cipher suite or enforce TLS1.3 in dqlite?

BTW, this vulnerability was not found in MicroK8s 1.23. Using nmap --script ssl-enum-ciphers -p 19001 hostname also showed that the 3DES is being supported in 1.27 while not in 1.23.

Thanks in advance Ryan

neoaggelos commented 1 year ago

Hi @ryanwong00 we will be adding a --min-tls-version flag in k8s-dqlite with #49