Ignore MDM server vulnerability due to TLS 1.0

Problem

For versions up to MCM 2.1, vulnerability scan on the MDM Server detects exposure due to MDM Server accepting connections using TLS 1.0 and TLS 1.1.

Cause

This vulnerability exposure is specific to the port 5671 only. Up to MCM 2.1, port 5671 uses TLS 1.0 for internal communication.

The encryptions through TLS 1.0 was formally deprecated in March 2021 due to security issues. Websites using TLS 1.0 are considered non-compliant by PCI since 30 June 2018. PCI Data Security Standard (PCI DSS) does not consider TLS 1.0 to be strong enough to protect sensitive information transferred to or from web sites.

Therefore, the vulnerability scan detects the exposure.

It does not impact the ports 443 or 8443 as TLS V1.2 or higher is forced for communications through these ports.

Solution

You can safely ignore the vulnerability alert regarding the use of TLS 1.0.

This is because this vulnerability impacts only port 5671, which is used only for communication between RabbitMQ and the MDM Plugins internally. This port is not exposed to the Internet. This connection is controlled by client/server certificates, and therefore, only the MDM Plugins with those specific client/server certificates can establish a connection to initiate internal communication. Without appropriate client certificates, even the internal communication cannot be established.

This will not be an issue in versions later than MCM 2.1, as TLS V1.2 or higher is forced for communications through all the ports, and hence will be completely TLS requirement compliant even for internal communication.