We have received a report of a vulnerability on VNA server:
Change the SSL/TLS server configuration to only allow strong key exchanges.
Key exchanges should provide at least 112 bits of security, which translates to a minimum key size of 2048 bits for Diffie Hellman and RSA key exchanges.
Release : 22.2.5 and older
Please follow below instruction to execute the command with root privilege.
.
.
[root@system ~]# whoami
root
[root@system ~]# cd /opt/CA/VNA/wildfly/bin/
[root@system bin]# ./jboss-cli.sh
You are disconnected at the moment. Type 'connect' to connect to the server or 'help' for the list of supported commands.
[disconnected /] connect
Unable to connect due to unrecognised server certificate
Subject - CN=system,OU=Broadcom,O=Support,L=Portsmouth,ST=NH,C=US
Issuer - CN=DX NetOps Intermediate
Valid From - Thu Dec 15 19:07:20 UTC 2022
Valid To - Fri Dec 15 19:07:19 UTC 2023
Subject - CN=DX NetOps
Issuer - CN=DX NetOps
Valid From - Wed Dec 07 16:31:30 UTC 2022
Valid To - Tue Dec 02 16:31:02 UTC 2042
Subject - CN=DX NetOps
Issuer - CN=DX NetOps
Valid From - Wed Dec 07 16:31:03 UTC 2022
Valid To - Tue Dec 02 16:31:02 UTC 2042
Accept certificate? [N]o, [T]emporarily, [P]ermanently : P
[standalone@localhost:9993 /] /subsystem=elytron/server-ssl-context=applicationSSC:write-attribute(name=cipher-suite-filter,value="ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-RSA-AES128-GCM-SHA256,ECDHE-ECDSA-AES256-GCM-SHA384,ECDHE-RSA-AES256-GCM-SHA384,ECDHE-ECDSA-CHACHA20-POLY1305,ECDHE-RSA-CHACHA20-POLY1305")
"outcome" => "success",
"response-headers" => {
"operation-requires-reload" => true,
"process-state" => "reload-required"
}
}
[standalone@localhost:9993 /] exit
[root@system bin]# systemctl restart wildfly
.
You only have to accept the jboss certs the first time the console is used, so you may not see that part.