This message was deleted.

Let's see, I think I copied the right link, otherwise Daniel Marsh had the same question that you can search for, in case the link doesn't work.. 😛 https://worldofeuc.slack.com/archives/CKHRXATV2/p1704949986039569

thanks Nicklas, this is the reply I just got from Citrix, similar to @Daniel Marsh but they included a workaround: Regarding CVE-2023-48795: During the Netscaler IP scan, the detection of the deprecated SHA1 Cipher is causing a scan failure. The Citrix Engineering team is working on the permanent fix, which is to upgrade OpenSSH in a future build. This is planned for June 2024. In the meantime, they provided a temporary workaround, that is modifying the NetScaler sshd_config file to exclude the SHA1 cipher -until the OpenSSH update is implemented-. Here is the config change to prevent the use of SHA1 ciphers: cp /etc/sshd_config /nsconfig/sshd_config chmod 777 /nsconfig/sshd_config; echo "ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc" >> /nsconfig/sshd_config echo "macs umac-64@openssh.com,hmac-sha2-256,hmac-sha2-512" >> /nsconfig/sshd_config kill -HUP

cat /var/run/sshd.pid

force HA sync -force -save YES exit reboot

Interesting. Keeping this in mind. Thx

Wonderful, thank you for sharing that and the workaround, too! 😃

@Shane Kleinert just in case we run into this during any pen test on this project with the VPX FIPS. Not even sure if the VPX would be the same scenario here as MPX or not. Haven't checked all that.

At least on the earlier releases the SSH config didn't "survive" firmware upgrade so you need to rerun that stuff post upgrade. Not sure what's the situation now?