Host is Vulnerable to Extended Master Secret TLS Extension

[RaaviTech]

Hi

Internal Vulnerability Scanner has flagged this-

Host is Vulnerable to Extended Master Secret TLS Extension (TLS triple handshake)

We updated RabitMQ to 3.8.2 version. How to fix this issue/vulnerability?

[Luke Bakken]

Hello,

RabbitMQ does not implement TLS, the Erlang VM and OpenSSL (or your operating-system specific SSL library) does.

You need to let us know the exact version of Erlang you're using, on what operating system (and version), and the version of OpenSSL on that system.

More than likely you'll have to upgrade OpenSSL and Erlang to address this, if you want to spend the effort - https://www.tripwire.com/state-of-security/security-data-protection/security-hardening/tls-extended-master-secret-extension-fixing-a-hole-in-tls/

Thanks -

Luke

[RaaviKids]

We are using Erlang 22.2 OTP win64.

Has anyone reported this problem.

Thanks

[RaaviKids]

This is setup on Windows server 2016. OpenSSL is not installed.

[Wesley Peng]

Windows Server has a lot of other vulnerability rather than this SSL one. Isn't it? :)

regards.

[Luke Bakken]

Hello -

Erlang on Windows is built using a statically linked OpenSSL so it is there, just not a separate library.

Since you're on the latest Erlang for Windows you can't address this TLS warning via an upgrade. You'll have to either live with it or mitigate it by using a TLS-terminating proxy.

Thanks -

Luke