TLS Edge compatibility

OWASP 2013-A5 OWASP 2017-A6 OWASP PC-C10 PCI v3.2- CAPEC-217 CWE-311 HIPAA-311 ISO27001-A.14.1.3 WASC-4 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N WSTG-CRYP-01

The TLS protocol is used to provide privacy and data integrity between two or more communicating computer applications. When secured by TLS, connections between a client and a server have one or more of the following properties:-

  1. The connection is private
  2. The identity of parties can be authenticated
  3. The connection is reliable

Transportation layer came from Secure Socket Layer. A careful configuration of TLS will provide additional privacy-related properties like forwarding secrecy, prevent discloser of encryption keys etc.

Some of the TLS certificates do not support old Edge versions.

Impact

The impact include:-

  • Renegotiation attack
  • Downgrade attacks like Logjam and FREAK
  • Cross-platform attacks like DROWN
  • BEAST attack
  • Breach attacks
  • POODLE attacks

Mitigation / Precautions

This vulnerability can be fixed by:-

  • Changing the TLS cipher for the user depending on the version of Edge.

Latest Articles