GOLDENDOODLE vulnerability found with ECDHE-RSA-AES256-SHA384 on TLSv1.2

[kolafsson]

We recently ran a scan on one of our sites and it’s coming up as a fail because of a cipher quite being used. ECDHE-RSA-AES256-SHA384 on TLSv1.2. GitHub - tls-attacker/TLS-Padding-Oracles: New TLS Padding Oracles

What i find weird is it scans with an A score using a quick scan SSL Server Test (Powered by Qualys SSL Labs) . but when the paid scanner product from Qualys scans it fails the site, because of that cipher suite. Has anyone else seen that or know if there is a way to turn off a cipher suite? I’ve created a ticket with cloudflare, I might make one with Qualys since this seems new as we scan quarterly, we have a paid business account.

[sdayman]

This message was part of a long thread on the subject:

What happens to those of us not in control of or own servers come end of May when most of Cloudlflare's TLSv1.2 cyphersuites end up failing our ratings on https://www.ssllabs.com due to semi-new POODLE variants?

Cloudflare isn’t effected by these *OODLE Variants. Disabling the CBC ciphers would effectively mean dropping support for TLS 1.0 and TLS 1.1, and as a consequence, support for basically every OS before 2015. SSL Labs identifies cipher suites using CBC with orange color and with text WEAK. This change won’t have any effect on the grades, as it only means that SSL Labs discourages the use of CBC-based cipher suites further. SSL Labs will start giving “F” grade to the server affected by these v…

[kolafsson]

We don’t want anyone connecting to our site with TLS 1.0 or 1.1 anyway. So that would be a positive for us and we have min support set to 1.2 already. So I guess I need to go to Qualys support and see why they failed our site for this when it should have only been marked as an orange weak according to their own blog posts?

Edit: so basically the solution was to just tell the vendor about this thread. and that it isn’t vulnerable. They took tat as acceptable.