Sweet32 vulnerability on Proliant iLO Firmware Version 2.71

[Steven_Reid]

Hi All,

We have recently performed some vulnerability scanning on our network and the iLO devices are coming up with the SSL Medium Strength Cipher Suites Supported (SWEET32) CVE-2016-2183 vulnerability.

The ILO devices are running firmware version 2.71

Is there a newer version of the firmware available, or is there a way to mitigate this issue?
How can we report it to HPE themselves?

Thanks

[support_s]

System recommended content:

1. Bulletin: (Revision) HPE Integrated Lights-Out 4 (iLO 4) - iLO 4 Is Vulnerable to CVE-2017-12542 and Can Be Exploited By the iLOBleed Root Kit

2. Advisory: HPE Integrated Lights-Out 4 (iLO 4) - Qualys Scan Report Displaying iLO 4 Firmware v1.64 as Vulnerable to Ripple20 on HPE Integrity Superdome X Server Is a False Positive

Please click on "Thumbs Up/Kudo" icon to give a "Kudo".

Thank you for being a HPE valuable community member.

[Steven_Reid]

Thanks for the response.

The XML link shows the machine as <SPN>ProLiant DL360 Gen10</SPN> 

and that the iLO is v 5

<MP>

<ST>1</ST>

<PN>Integrated Lights-Out 5 (iLO 5)</PN>

<FWRI>2.71</FWRI>

Are you saying that even for this device, it is a false positive?

[Suman_1978 · Accepted solution]

Hi,

To report a potential security vulnerability for any HPE supported product:

Web Form: https://www.hpe.com/info/report-security-vulnerability

Thank You!
I work with HPE but opinions expressed here are mine.
Recent Support Video Releases

[Steven_Reid]

Thank you.

i have copmpleted that form

[Sunitha_Mod]

Hello @Steven_Reid, 

We are glad to know your concern has been addressed. 

[FBreen]

We had the same issue. and have resolved it. 

We started first with latest Firmware ilo5_278.fwpkg - this did not reolved it. 

Go to Security - Encryption - then 

Update Security Settings

change to High Security - apply and reboot ILO . this will resolve the issue

We are only using TLS 1.2  as well