CVE-2023-20107

highPriorität · verfolgen · 30EPSS 0.007 · 54. PerzentilEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.72% (54th) EPSS

CVSS 7.5 · high

Is it mine?

74 products

Prüfe deine Angriffsfläche

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · cisco_csaf

EPSS · bewertet 2026-10-27

A vulnerability in the deterministic random bit generator (DRBG), also known as pseudorandom number generator (PRNG), in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software for Cisco ASA 5506-X, ASA 5508-X, and ASA 5516-X Firewalls could allow an unauthenticated, remote attacker to cause a cryptographic collision, enabling the attacker to discover the private key of an affected device. This vulnerability is due to insufficient entropy in the DRBG for the affected hardware platforms when generating cryptographic keys. An attacker could exploit this vulnerability by generating a large number of cryptographic keys on an affected device and looking for collisions with target devices. A successful exploit could allow the attacker to impersonate an affected target device or to decrypt traffic secured by an affected key that is sent to or from an affected target device.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.1 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.1.5 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.1.7 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.14 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.15 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.17 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.20 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.24 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.26 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.28 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.33 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.35 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.38 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.45 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.8 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.3 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.3.11 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.3.14 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.3.16 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.3.18 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.3.21 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.3.26 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.3.29 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.3.8 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.10 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.12 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.15 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.17 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.20 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.22 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.25 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.26 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.29 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.3 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.32 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.33 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.34 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.35 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.39 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.40 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.41 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.43 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.44 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.45 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.46 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.48 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.7 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.8 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Threat Defense (FTD) Software 6.2.3 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.1 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.10 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.11 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.12 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.13 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.14 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.15 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.16 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.17 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.18 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.2 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.3 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.4 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.5 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.6 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.7 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.8 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.9 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.1 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.1.5 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.1.7 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.14 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.15 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.17 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.20 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.24 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.26 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.28 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.33 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.35 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.38 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.45 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.8 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.3 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.3.11 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.3.14 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.3.16 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.3.18 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.3.21 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.3.26 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.3.29 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.3.8 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.10 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.12 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.15 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.17 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.20 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.22 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.25 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.26 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.29 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.3 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.32 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.33 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.34 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.35 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.39 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.40 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.41 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.43 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.44 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.45 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.46 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.48 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.7 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.8 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.1 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.10 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.11 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.12 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.13 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.14 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.15 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.16 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.17 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.18 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.2 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.3 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.4 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.5 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.6 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.7 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.8 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.9 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.5

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 5.3–7.5

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 3.6

v3.05.3mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · ENISA EU

v3.05.3mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · psirt@cisco.com USAusnutzbarkeit 3.9 · Auswirkung 1.4

v3.05.3mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · Cisco PSIRT US

v3.15.3mediumAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · FSTEC (BDU) RU

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-331USprimärCWE-332USCWE-332US

betroffene Produkte (74)

Betroffene Produkte und Versionsbereiche.

20 von 74 angezeigt

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

cisco-sa-asa5500x-entropy-6v9bHVYPCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Low-Entropy Keys Vulnerability2023-03-22csaf · cisco_csafUS
A vulnerability in the deterministic random bit generator (DRBG), also known as pseudorandom number generator (PRNG), in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software for Cisco ASA 5506-X, ASA 5508-X, and ASA 5516-X Firewalls could allow an unauthenticated, remote attacker to cause a cryptographic collision, enabling the attacker to discover the private key of an affected device. This vulnerability is due to insufficient entropy in the DRBG for the affected hardware platforms when generating cryptographic keys. An attacker could exploit this vulnerability by generating a large number of cryptographic keys on an affected device and looking for collisions with target devices. A successful exploit could allow the attacker to impersonate an affected target device or to decrypt traffic secured by an affected key that is sent to or from an affected target device. Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability for some affected configurations.

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu cisco_csaf NVD CVE.org MITRE

veröffentlicht 2023-03-23geändert 2026-08-11

verwandt (185)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2008-1447US	medium6.8	95.2% (100th)	Exploit	2008-07-08
The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; an…
CVE-2018-18326US	high7.5	54.3% (99th)	Exploit	2019-07-03
DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy. NOTE: this issue exists because of an incomplete…
CVE-2004-0230US	medium5.0	80.3% (100th)	Exploit	2004-08-18
TCP, when using a large Window Size, makes it easier for remote attackers to guess sequence numbers and cause a denial of service (connection loss) to persistent TCP connections by…
CVE-2018-15812US	high7.5	47.2% (99th)	Exploit	2019-07-03
DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy.
CVE-2000-0384US	high10.0OT hoch	5.89% (93rd)	Exploit	2000-05-08
NetStructure 7110 and 7180 have undocumented accounts (servnow, root, and wizard) whose passwords are easily guessable from the NetStructure's MAC address, which could allow remote…

+180 weitere

Referenzen (4)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan