The SSH server is configured to support Cipher Block Chaining (CBC) encryption. This may allow an attacker to recover the plain text message from the ciphertext. Note that this plugin only checks for the options of the SSH server and does not check for vulnerable software versions.
Contact the vendor or consult product documentation to disable CBC mode cipher encryption, and enable CTR or GCM cipher mode encryption.
You may contact the vendor or consult the product documentation to disable CBC mode cipher encryption, and enable CTR or GCM cipher mode encryption.
- The following client-to-server CBC algorithms are supported:
- 3des-cbc
- aes128-cbc
- aes192-cbc
- aes256-cbc
- blowfish-cbc
- cast128-cbc
- rijndael-cbc@lysator.liu.se
- The following server-to-client CBC algorithms are supported:
- 3des-cbc
- aes128-cbc
- aes192-cbc
- aes256-cbc
- blowfish-cbc
- cast128-cbc
- rijndael-cbc@lysator.liu.se
Click image to enlarge.
For this vulnerability scan result, modify the configuration of SSHD to fix the issue: