This message was deleted.

My current Ciphers in my Cipher group 1) Cipher Name: TLS1.3-AES256-GCM-SHA384 Priority : 1 Description: TLSv1.3 Kx=any Au=any Enc=AES-GCM(256) Mac=AEAD Hex Code=0x1302 2) Cipher Name: TLS1.3-AES128-GCM-SHA256 Priority : 3 Description: TLSv1.3 Kx=any Au=any Enc=AES-GCM(128) Mac=AEAD Hex Code=0x1301 3) Cipher Name: TLS1.2-ECDHE-ECDSA-AES128-GCM-SHA256 Priority : 4 Description: TLSv1.2 Kx=ECC-DHE Au=ECDSA Enc=AES-GCM(128) Mac=AEAD He xCode=0xc02b 4) Cipher Name: TLS1.2-ECDHE-ECDSA-AES256-GCM-SHA384 Priority : 5 Description: TLSv1.2 Kx=ECC-DHE Au=ECDSA Enc=AES-GCM(256) Mac=AEAD He xCode=0xc02c 5) Cipher Name: TLS1.2-ECDHE-ECDSA-AES128-SHA256 Priority : 6 Description: TLSv1.2 Kx=ECC-DHE Au=ECDSA Enc=AES(128) Mac=SHA-256 He xCode=0xc023 6) Cipher Name: TLS1.2-ECDHE-ECDSA-AES256-SHA384 Priority : 7 Description: TLSv1.2 Kx=ECC-DHE Au=ECDSA Enc=AES(256) Mac=SHA-384 He xCode=0xc024 7) Cipher Name: TLS1-ECDHE-ECDSA-AES128-SHA Priority : 8 Description: SSLv3 Kx=ECC-DHE Au=ECDSA Enc=AES(128) Mac=SHA1 HexCode =0xc009 8) Cipher Name: TLS1-ECDHE-ECDSA-AES256-SHA Priority : 9 Description: SSLv3 Kx=ECC-DHE Au=ECDSA Enc=AES(256) Mac=SHA1 HexCode =0xc00a 9) Cipher Name: TLS1.2-ECDHE-RSA-AES128-GCM-SHA256 Priority : 10 Description: TLSv1.2 Kx=ECC-DHE Au=RSA Enc=AES-GCM(128) Mac=AEAD Hex Code=0xc02f 10) Cipher Name: TLS1.2-ECDHE-RSA-AES256-GCM-SHA384 Priority : 11 Description: TLSv1.2 Kx=ECC-DHE Au=RSA Enc=AES-GCM(256) Mac=AEAD Hex Code=0xc030 11) Cipher Name: TLS1.2-ECDHE-RSA-AES-128-SHA256 Priority : 12 Description: TLSv1.2 Kx=ECC-DHE Au=RSA Enc=AES(128) Mac=SHA-256 Hex Code=0xc027 12) Cipher Name: TLS1.2-ECDHE-RSA-AES-256-SHA384 Priority : 13 Description: TLSv1.2 Kx=ECC-DHE Au=RSA Enc=AES(256) Mac=SHA-384 Hex Code=0xc028 13) Cipher Name: TLS1-ECDHE-RSA-AES128-SHA Priority : 14 Description: SSLv3 Kx=ECC-DHE Au=RSA Enc=AES(128) Mac=SHA1 HexCode= 0xc013 14) Cipher Name: TLS1-ECDHE-RSA-AES256-SHA Priority : 15 Description: SSLv3 Kx=ECC-DHE Au=RSA Enc=AES(256) Mac=SHA1 HexCode= 0xc014 15) Cipher Name: TLS1.2-DHE-RSA-AES128-GCM-SHA256 Priority : 16 Description: TLSv1.2 Kx=DH Au=RSA Enc=AES-GCM(128) Mac=AEAD Hex Code=0x009e 16) Cipher Name: TLS1.2-DHE-RSA-AES256-GCM-SHA384 Priority : 17 Description: TLSv1.2 Kx=DH Au=RSA Enc=AES-GCM(256) Mac=AEAD Hex Code=0x009f 17) Cipher Name: TLS1-DHE-RSA-AES-128-CBC-SHA Priority : 18 Description: SSLv3 Kx=DH Au=RSA Enc=AES(128) Mac=SHA1 HexCode= 0x0033 18) Cipher Name: TLS1-DHE-RSA-AES-256-CBC-SHA Priority : 19 Description: SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 HexCode= 0x0039 19) Cipher Name: TLS1-AES-128-CBC-SHA Priority : 20 Description: SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 HexCode= 0x002f 20) Cipher Name: TLS1-AES-256-CBC-SHA Priority : 21 Description: SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 HexCo

Any of the ciphers with "CBC" will potentially be vulnerable from the looks of it

1. NetScaler Gateway doesn't support DTLS 1.2 so TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 and TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 are not supported and NetScaler Gateway must be configured to use TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA for it to work in DTLS 1.0

Would be helpful if the pen-testers gave you the ciphers they're flagging - doesn't seem to be a lot of info in the wild on it

yeah i had a quick google for lucky13 Netscaler and nothing really came up. I also got a 2048 DH key for forward secrecy for DHE suites. I was under the impression that ECDHE suites replaced DHE

looking at the little there is on it, it looks super low risk for exploits, you'd have to be on the same local network as the vServer to exploit the timing issue - I'd push back on the pen-testers for some more context personally, although depends if they're actual security people or just running a test framework as to whether you'll get anything useful

Thanks 👍