Seeing (SSL/TLS Compression Algorithm Information Leakage Vulnerability port 8089/tcp over SSL) from qualys scanning

ncsasecops — Tue, 26 Jan 2021 21:35:34 GMT

We are seeing this vulnerability show up via qualys vuln scanning on both our dev and production splunk instances. I am using the same ssl config for both and have tried solving this multiple ways including the first solution proposed here: https://community.splunk.com/t5/Getting-Data-In/I-am-looking-for-clarification-on-SSL-compression-settings-in/m-p/126153

this is what our ssl and http server config in server.conf looks like currently:

[sslConfig]

sslPassword = $encryptedsslpass$

serverCert = $servercertpath$

caCertFile = $cacertpath$

sendStrictTransportSecurityHeader=true

useSSLCompression = false

allowSSLCompression = false

sslVersions = tls1.2

sslVersionsForClient = tls1.2

cipherSuite = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:AES256-GCM-SHA384:AES128-GCM-SHA256:AES128-SHA256

[httpServer]

replyHeader.X-XSS-Protection= 1; mode=block

replyHeader.Content-Security-Policy = script-src 'self'; object-src 'self'

Is there anything I need to add to this config or elsewhere to solve this vulnerability? I do not want to block the scanner from seeing the port as I have seen proposed in some solutions.

Re: Seeing (SSL/TLS Compression Algorithm Information Leakage Vulnerability port 8089/tcp over SSL) from qualys scanning

CALEX — Tue, 05 Oct 2021 18:16:12 GMT

I'm having the same issue. Did you ever find a resolution?

Re: Seeing (SSL/TLS Compression Algorithm Information Leakage Vulnerability port 8089/tcp over SSL) from qualys scanning

k_sam — Wed, 25 May 2022 09:31:44 GMT

If this is regarding CVE-2012-4929 probably you should check below.

https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-shows-vulnerable-to-CVE-2012-4929-in-my-Nessus/m-p/29091

topic Seeing (SSL/TLS Compression Algorithm Information Leakage Vulnerability port 8089/tcp over SSL) from qualys scanning in Splunk Enterprise Security

Seeing (SSL/TLS Compression Algorithm Information Leakage Vulnerability port 8089/tcp over SSL) from qualys scanning

Re: Seeing (SSL/TLS Compression Algorithm Information Leakage Vulnerability port 8089/tcp over SSL) from qualys scanning

Re: Seeing (SSL/TLS Compression Algorithm Information Leakage Vulnerability port 8089/tcp over SSL) from qualys scanning