Security: SSL Medium Strength Ciphers (SWEET32) reported on kubernetes and docker ports

[Ghada Khalil]

Brief Description
-----------------
Nessus scan reports the following medium security finding:
SSL Medium Strength Ciphers (SWEET32): kubernetes and docker ports
This is reported on K8s port 6443 and docker port 9002 (docker registry token server).

Severity
--------
Major - security concern

Branch/Pull Time/Commit
-----------------------
Tested on stx master

Test Activity
-------------
Security Scan

[Ghada Khalil (gkhalil)]

Would be nice to fix in stx.4.0 as this is a security concern

[Michel Thebeau [WIND] (mthebeau)]

The nessus report text is:

42873 (4) - SSL Medium Strength Cipher Suites Supported (SWEET32)

(tcp/6443)

Medium Strength Ciphers (> 64-bit and < 112-bit key, or 3DES)

ECDHE-RSA-DES-CBC3-SHA Kx=ECDH Au=RSA Enc=3DES-CBC(168) Mac=SHA1
DES-CBC3-SHA Kx=RSA Au=RSA Enc=3DES-CBC(168) Mac=SHA1

The fields above are :

{OpenSSL ciphername}
Kx={key exchange}
Au={authentication}
Enc={symmetric encryption method}
Mac={message authentication code}
{export flag}

(tcp/9002)

Medium Strength Ciphers (> 64-bit and < 112-bit key, or 3DES)

ECDHE-RSA-DES-CBC3-SHA Kx=ECDH Au=RSA Enc=3DES-CBC(168) Mac=SHA1
DES-CBC3-SHA Kx=RSA Au=RSA Enc=3DES-CBC(168) Mac=SHA1

The fields above are :

{OpenSSL ciphername}
Kx={key exchange}
Au={authentication}
Enc={symmetric encryption method}
Mac={message authentication code}
{export flag}

Per our discussion, the kube-apiserver version at the time of report was v1.16.2

[Ghada Khalil (gkhalil)]

Lowering the priority. This is a would-be-nice to fix, but doesn't strictly hold up stx.4.0