[DIRSERVER-2078] High Security Vulnerabilities Found when using LDAPs

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Not A Problem
• Affects Version/s: 2.0.0-M20
• Component/s: ldap
• Labels: security
• Environment: Server 2008 R2, Java 8
• Flags: Important
• Assignee: Unassigned
• Reporter: KobieIT
• Created: 30/Jun/15 15:10
• Updated: 06/Jun/19 13:44
• Resolved: 06/Jun/19 13:44

Description

Recent internal Qualys vulnerability scans are reporting High Security vulnerabilities when using LDAPs. I have searched through the documentation and cannot find any remediation to these issues.

Currently have LDAPs enabled, TLS enabled and Server Side password hashing enabled. Allow anonymous access is disabled

Issues found
1. SSL/TLS Server Factoring RSA Export Keys (FREAK) vulnerability
2. SSL Server Allows Anonymous Authentication Vulnerability
3. SSL Server Allows Cleartext Communication Vulnerability

Any help would be appreciated.