CVE-2024-20494
highpriority · track · 0EPSS 0.005 · 44 %ileDEEUNLRUUSEPSS · scored 2026-10-26
A vulnerability in the TLS cryptography functionality of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to improper data validation during the TLS 1.3 handshake. An attacker could exploit this vulnerability by sending a crafted TLS 1.3 packet to an affected system through a TLS 1.3-enabled listening socket. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition. Note: This vulnerability can also impact the integrity of a device by causing VPN HostScan communication failures or file transfer failures when Cisco ASA Software is upgraded using Cisco Adaptive Security Device Manager (ASDM).
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1 when installed on Cisco Adaptive Security Virtual Appliance (ASAv)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1 when installed on Cisco Firepower 1000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.12 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.12 when installed on Cisco Adaptive Security Virtual Appliance (ASAv)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.12 when installed on Cisco Firepower 1000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.12 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.12 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.12 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.12 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.18 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.18 when installed on Cisco Adaptive Security Virtual Appliance (ASAv)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.18 when installed on Cisco Firepower 1000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.18 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.18 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.18 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.18 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.22 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.22 when installed on Cisco Adaptive Security Virtual Appliance (ASAv)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.22 when installed on Cisco Firepower 1000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.22 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.22 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.22 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.22 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.24 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.24 when installed on Cisco Adaptive Security Virtual Appliance (ASAv)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.24 when installed on Cisco Firepower 1000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.24 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.24 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.24 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.24 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.27 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.27 when installed on Cisco Adaptive Security Virtual Appliance (ASAv)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.27 when installed on Cisco Firepower 1000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.27 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.27 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.27 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.27 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.28 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.28 when installed on Cisco Adaptive Security Virtual Appliance (ASAv)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.28 when installed on Cisco Firepower 1000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.28 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.28 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.28 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.28 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.31 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.31 when installed on Cisco Adaptive Security Virtual Appliance (ASAv)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.31 when installed on Cisco Firepower 1000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.31 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.31 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.31 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.31 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.5 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.5 when installed on Cisco Adaptive Security Virtual Appliance (ASAv)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.5 when installed on Cisco Firepower 1000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.5 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.5 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.5 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.5 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.9 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.9 when installed on Cisco Adaptive Security Virtual Appliance (ASAv)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.9 when installed on Cisco Firepower 1000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.9 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.9 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.9 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.9 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.1 when installed on Cisco Secure Firewall 4200 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.1.5 when installed on Cisco Secure Firewall 4200 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2 when installed on Cisco Adaptive Security Virtual Appliance (ASAv)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2 when installed on Cisco Firepower 1000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2 when installed on Cisco Secure Firewall 4200 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.10 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.10 when installed on Cisco Adaptive Security Virtual Appliance (ASAv)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.10 when installed on Cisco Firepower 1000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.10 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.10 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.10 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.10 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.10 when installed on Cisco Secure Firewall 4200 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.21 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.21 when installed on Cisco Adaptive Security Virtual Appliance (ASAv)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.21 when installed on Cisco Firepower 1000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.21 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.21 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.21 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.21 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.21 when installed on Cisco Secure Firewall 4200 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.22 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.22 when installed on Cisco Adaptive Security Virtual Appliance (ASAv)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.22 when installed on Cisco Firepower 1000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.22 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.22 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.22 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.22 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.22 when installed on Cisco Secure Firewall 4200 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.3 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.3 when installed on Cisco Adaptive Security Virtual Appliance (ASAv)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.3 when installed on Cisco Firepower 1000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.3 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.3 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.3 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.3 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.3 when installed on Cisco Secure Firewall 4200 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.3.0 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.3.0 when installed on Cisco Firepower 1000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.3.0 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.3.0 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.3.0 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.3.0 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.3.0 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.3.1 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.3.1 when installed on Cisco Firepower 1000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.3.1 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.3.1 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.3.1 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.3.1 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.3.1 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.3.1.1 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.3.1.1 when installed on Cisco Firepower 1000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.3.1.1 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.3.1.1 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.3.1.1 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.3.1.1 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.3.1.1 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.3.1.2 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.3.1.2 when installed on Cisco Firepower 1000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.3.1.2 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.3.1.2 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.3.1.2 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.3.1.2 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.3.1.2 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.4.0 when installed on Cisco Secure Firewall 4200 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.4.1 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.4.1 when installed on Cisco Firepower 1000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.4.1 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.4.1 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.4.1 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.4.1 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.4.1 when installed on Cisco Secure Firewall 4200 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.4.1 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.4.1.1 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.4.1.1 when installed on Cisco Firepower 1000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.4.1.1 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.4.1.1 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.4.1.1 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.4.1.1 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.4.1.1 when installed on Cisco Secure Firewall 4200 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.4.1.1 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.4.2 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.4.2 when installed on Cisco Firepower 1000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.4.2 when installed on Cisco Firepower 2100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.4.2 when installed on Cisco Firepower 4100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.4.2 when installed on Cisco Firepower 9000 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.4.2 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.4.2 when installed on Cisco Secure Firewall 4200 Seriescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Secure Firewall Threat Defense (FTD) Software 7.4.2 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1 when installed on Cisco Adaptive Security Virtual Appliance (ASAv)cisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1 when installed on Cisco Firepower 1000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1 when installed on Cisco Firepower 2100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1 when installed on Cisco Firepower 4100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1 when installed on Cisco Firepower 9000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.12 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.12 when installed on Cisco Adaptive Security Virtual Appliance (ASAv)cisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.12 when installed on Cisco Firepower 1000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.12 when installed on Cisco Firepower 2100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.12 when installed on Cisco Firepower 4100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.12 when installed on Cisco Firepower 9000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.12 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.18 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.18 when installed on Cisco Adaptive Security Virtual Appliance (ASAv)cisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.18 when installed on Cisco Firepower 1000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.18 when installed on Cisco Firepower 2100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.18 when installed on Cisco Firepower 4100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.18 when installed on Cisco Firepower 9000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.18 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.22 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.22 when installed on Cisco Adaptive Security Virtual Appliance (ASAv)cisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.22 when installed on Cisco Firepower 1000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.22 when installed on Cisco Firepower 2100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.22 when installed on Cisco Firepower 4100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.22 when installed on Cisco Firepower 9000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.22 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.24 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.24 when installed on Cisco Adaptive Security Virtual Appliance (ASAv)cisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.24 when installed on Cisco Firepower 1000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.24 when installed on Cisco Firepower 2100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.24 when installed on Cisco Firepower 4100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.24 when installed on Cisco Firepower 9000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.24 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.27 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.27 when installed on Cisco Adaptive Security Virtual Appliance (ASAv)cisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.27 when installed on Cisco Firepower 1000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.27 when installed on Cisco Firepower 2100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.27 when installed on Cisco Firepower 4100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.27 when installed on Cisco Firepower 9000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.27 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.28 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.28 when installed on Cisco Adaptive Security Virtual Appliance (ASAv)cisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.28 when installed on Cisco Firepower 1000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.28 when installed on Cisco Firepower 2100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.28 when installed on Cisco Firepower 4100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.28 when installed on Cisco Firepower 9000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.28 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.31 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.31 when installed on Cisco Adaptive Security Virtual Appliance (ASAv)cisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.31 when installed on Cisco Firepower 1000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.31 when installed on Cisco Firepower 2100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.31 when installed on Cisco Firepower 4100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.31 when installed on Cisco Firepower 9000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.31 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.5 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.5 when installed on Cisco Adaptive Security Virtual Appliance (ASAv)cisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.5 when installed on Cisco Firepower 1000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.5 when installed on Cisco Firepower 2100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.5 when installed on Cisco Firepower 4100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.5 when installed on Cisco Firepower 9000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.5 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.9 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.9 when installed on Cisco Adaptive Security Virtual Appliance (ASAv)cisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.9 when installed on Cisco Firepower 1000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.9 when installed on Cisco Firepower 2100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.9 when installed on Cisco Firepower 4100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.9 when installed on Cisco Firepower 9000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.19.1.9 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.1 when installed on Cisco Secure Firewall 4200 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.1.5 when installed on Cisco Secure Firewall 4200 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2 when installed on Cisco Adaptive Security Virtual Appliance (ASAv)cisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2 when installed on Cisco Firepower 1000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2 when installed on Cisco Firepower 2100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2 when installed on Cisco Firepower 4100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2 when installed on Cisco Firepower 9000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2 when installed on Cisco Secure Firewall 4200 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.10 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.10 when installed on Cisco Adaptive Security Virtual Appliance (ASAv)cisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.10 when installed on Cisco Firepower 1000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.10 when installed on Cisco Firepower 2100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.10 when installed on Cisco Firepower 4100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.10 when installed on Cisco Firepower 9000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.10 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.10 when installed on Cisco Secure Firewall 4200 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.21 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.21 when installed on Cisco Adaptive Security Virtual Appliance (ASAv)cisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.21 when installed on Cisco Firepower 1000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.21 when installed on Cisco Firepower 2100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.21 when installed on Cisco Firepower 4100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.21 when installed on Cisco Firepower 9000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.21 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.21 when installed on Cisco Secure Firewall 4200 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.22 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.22 when installed on Cisco Adaptive Security Virtual Appliance (ASAv)cisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.22 when installed on Cisco Firepower 1000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.22 when installed on Cisco Firepower 2100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.22 when installed on Cisco Firepower 4100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.22 when installed on Cisco Firepower 9000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.22 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.2.22 when installed on Cisco Secure Firewall 4200 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.3 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.3 when installed on Cisco Adaptive Security Virtual Appliance (ASAv)cisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.3 when installed on Cisco Firepower 1000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.3 when installed on Cisco Firepower 2100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.3 when installed on Cisco Firepower 4100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.3 when installed on Cisco Firepower 9000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.3 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.3 when installed on Cisco Secure Firewall 4200 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.3.0 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.3.0 when installed on Cisco Firepower 1000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.3.0 when installed on Cisco Firepower 2100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.3.0 when installed on Cisco Firepower 4100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.3.0 when installed on Cisco Firepower 9000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.3.0 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.3.0 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.3.1 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.3.1 when installed on Cisco Firepower 1000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.3.1 when installed on Cisco Firepower 2100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.3.1 when installed on Cisco Firepower 4100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.3.1 when installed on Cisco Firepower 9000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.3.1 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.3.1 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.3.1.1 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.3.1.1 when installed on Cisco Firepower 1000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.3.1.1 when installed on Cisco Firepower 2100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.3.1.1 when installed on Cisco Firepower 4100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.3.1.1 when installed on Cisco Firepower 9000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.3.1.1 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.3.1.1 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.3.1.2 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.3.1.2 when installed on Cisco Firepower 1000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.3.1.2 when installed on Cisco Firepower 2100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.3.1.2 when installed on Cisco Firepower 4100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.3.1.2 when installed on Cisco Firepower 9000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.3.1.2 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.3.1.2 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.4.0 when installed on Cisco Secure Firewall 4200 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.4.1 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.4.1 when installed on Cisco Firepower 1000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.4.1 when installed on Cisco Firepower 2100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.4.1 when installed on Cisco Firepower 4100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.4.1 when installed on Cisco Firepower 9000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.4.1 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.4.1 when installed on Cisco Secure Firewall 4200 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.4.1 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.4.1.1 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.4.1.1 when installed on Cisco Firepower 1000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.4.1.1 when installed on Cisco Firepower 2100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.4.1.1 when installed on Cisco Firepower 4100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.4.1.1 when installed on Cisco Firepower 9000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.4.1.1 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.4.1.1 when installed on Cisco Secure Firewall 4200 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.4.1.1 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.4.2 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)cisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.4.2 when installed on Cisco Firepower 1000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.4.2 when installed on Cisco Firepower 2100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.4.2 when installed on Cisco Firepower 4100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.4.2 when installed on Cisco Firepower 9000 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.4.2 when installed on Cisco Secure Firewall 3100 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.4.2 when installed on Cisco Secure Firewall 4200 Seriescisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 7.4.2 when installed on Cisco Secure Firewall Threat Defense Virtualcisco_csaf
If an affected device is running a Cisco ASA Software or FTD Software release that supports the ssl server-max-version command, administrators may disable TLS 1.3 as a workaround for this vulnerability. Note: The ssl server-max-version CLI command is supported as of Cisco ASA Software releases 9.19.1.24 and 9.20.2 and Cisco FTD Software Release 7.4.1. Disable TLS 1.3 on Cisco ASA Software To disable TLS 1.3 on Cisco ASA Software, set the minimum and maximum TLS version to TLS 1.2 using the ssl server-version and ssl server-max-version commands, as shown in the following example: ciscoasa# configure terminal ciscoasa(config)# ssl server-version tlsv1.2 dtlsv1.2 ciscoasa(config)# ssl server-max-version tlsv1.2 Disable TLS 1.3 on Cisco FTD Software To disable TLS 1.3 on Cisco FTD Software, set the minimum and maximum TLS version to TLS 1.2 using Cisco FMC Software and a FlexConfig object. For more information about FlexConfig objects, see the FlexConfig Policies for FTD ["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html"] chapter of the Firepower Management Center Configuration Guide. To disable TLS 1.3 on Cisco FTD Software, use the following steps: Connect to Cisco FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, choose TLSv1.2. Click Save. Choose Objects > Object Management. From the navigation menu on the left, choose FlexConfig > FlexConfig Object. Click Add FlexConfig Object. Enter a name and description (optional) for the object in the appropriate fields. From the drop-down menus above the main text box, choose Insert, Deployment: Once, and Type: Append. In the main text box, enter ss server-max-version tlsv1.2. Note: There is no l at the end of the word ss. This is not a typo. If the word ssl is used, Cisco FMC Software will display a validation error when the changes are saved. Click Save. From the menu bar, choose Devices > FlexConfig. Edit the existing FlexConfig Policy or add a new one. If a new policy is being added, enter a name and description (optional) for the new policy in the appropriate fields, then click Save. From the User Defined drop-down menu on the left, choose the FlexConfig object that was added in step 9. Click > to move the object to the Selected Append FlexConfigs pane. Click Save. From the menu bar, click Deploy to deploy the changes. Check the check boxes for devices that are assigned to the policy. Check the ignore warnings check box. Note: When deploying a FlexConfig object, a validation warning will prevent the deployment until the ignore warnings check box is checked. In the dialog box, click Deploy. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (242)
Products and version ranges known to be affected.
- Cisco ASA (Adaptive Security Appliance)all versionscert_bundDEcpe:/h:cisco:adaptive_security_appliance:-
advisories (3)
Vendor and ecosystem advisories describing this.
- NCSC-2024-0424Kwetsbaarheden verholpen in Cisco Adaptive Security Appliance en Firepower Threat DefenseNL2024-10-24csaf · ncsc_nlNL
Cisco heeft kwetsbaarheden verholpen in Adaptive Security Appliance (ASA) en Firepower Threat Defense (FTD).
- WID-SEC-W-2024-3262Cisco Firepower und ASA: Mehrere SchwachstellenDeutsch2024-10-23csaf · cert_bundDE
Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Cisco Firepower und Cisco ASA (Adaptive Security Appliance) ausnutzen, um Sicherheitsvorkehrungen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen, beliebigen Code auszuführen, erhöhte Rechte zu erlangen und einen Cross-Site-Scripting-Angriff durchzuführen.
- cisco-sa-asa-tls-CWY6zXBCisco Adaptive Security Appliance and Firepower Threat Defense Software TLS Denial of Service Vulnerability2024-10-23csaf · cisco_csafUS
A vulnerability in the TLS cryptography functionality of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to improper data validation during the TLS 1.3 handshake. An attacker could exploit this vulnerability by sending a crafted TLS 1.3 packet to an affected system through a TLS 1.3-enabled listening socket. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition. Note: This vulnerability can also impact the integrity of a device by causing VPN HostScan communication failures or file transfer failures when Cisco ASA Software is upgraded using Cisco Adaptive Security Device Manager (ASDM). Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability. This advisory is part of the October 2024 release of the Cisco ASA, FMC, and FTD Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: October 2024 Semiannual Cisco ASA, FMC, and FTD Software Security Advisory Bundled Publication ["https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75300"].
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (4)
External citations — patches, advisories, analysis.
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-tls-CWY6zXBcnnvd
- https://vigilance.fr/vulnerability/Cisco-ASA-multiple-vulnerabilities-dated-23-10-2024-45458cnnvd
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-tls-CWY6zXBenisa_euvd
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-tls-CWY6zXBMitigationVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan