Weak cipher suites
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 92
- Forks
- 81
- Avg merge
- 1d 9h
- Merged PRs (30d)
- 46
Description
Describe the bug
A clear and concise description of what the bug is.
It looks like APIML has enabled weak ciphers such as TLS_RSA_WITH_AES_128_CBC_SHA and TLS_RSA_WITH_AES_128_GCM_SHA256 in https://github.com/zowe/api-layer/pull/4025/files
some of these were removed around Zowe v1.26 per IBM scans due to the ROBOT attack https://robotattack.org/ recommending it
See https://ciphersuite.info/cs/TLS_RSA_WITH_AES_128_CBC_SHA/ as well.
I understand this PR was made to achieve easy compatibility with certain external servers like z/OSMF, but if those servers have weak ciphers, it's the administrators duty to either use secure ciphers, or downgrade Zowe at their own risk. Zowe should not default to weak ciphers and it will show up in scans.
Expected behavior
API ML is by default configured with secure cipher suites.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the files changed in API Layer pull request #4025 and the current API ML TLS cipher configuration. Compare the enabled suites with the named weak ciphers and the ROBOT guidance. Done means API ML defaults to secure cipher suites while compatibility remains an explicit administrator choice.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- api, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100