> Source: [sk181833](https://support.checkpoint.com/results/sk/sk181833)

# sk181833 - Check Point response to CVE-2023-48795 

| Property | Value |
|----------|-------|
| Solution ID | sk181833 |
| Date Created | 2023-12-24 |
| Last Modified | 2026-07-12 |
| Technical Level | General |
| Products | Scalable Platforms |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |

## Symptoms

- * The SSH transport protocol with some OpenSSH extensions, found in OpenSSH before version 9.6 and in other products, lets remote attackers bypass integrity checks, such that some packets are omitted from the extension negotiation message. A client and server may consequently end up with a connection for which some security features have been downgraded or disabled (also known as a Terrapin attack).

  <br />

  One of OpenSSH's default-enabled cipher algorithms is vulnerable: `chacha20-poly1305`.

  <br />

  Read more about CVE-2023-48795 [**here**](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-48795).

  <br />

* SMB (Gaia Embedded OS) is not vulnerable.

## Solution

This problem was fixed. The fix is included starting from:

* [Check Point R82](https://support.checkpoint.com/results/sk/sk181127)

Check Point recommends to always upgrade to the [Recommended version](https://support.checkpoint.com/results/sk/sk95746).

If you choose not to upgrade, [contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for your version.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing it.  
For faster resolution and verification, collect these files:

1. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Management Server involved in the case.
2. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Security Gateway / each Cluster Member involved in the case.

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://support.checkpoint.com/results/sk/sk168597).  

### Workaround for Versions R81.20 and Earlier

For versions R81.20 and earlier, follow the relevant procedure below to disable the "`chacha20-poly1305`" cipher in OpenSSH.

#### Procedure for R81.10 and R81.20 Security Gateways / Management Servers / Log Servers

Show / Hide this section  

**Note:** ForR81.10 Scalable Platforms, make the make the changes in Gaia Clish on each Security Group Member (SGM). For R81.20 Scalable platforms, the commands in the procedure are supported in Gaia gClish.  

1. Connect to the command line on the appliance.
2. Show the list of enabled ciphers. In the list, look for *chacha20-poly1305@openssh.com.* `show ssh server cipher enabled`
3. Set the`hacha20-poly1305@openssh.com` cipher to `off`.   
   ` set ssh server cipher chacha20-poly1305@openssh.com off`
4. Save the configuration.  
   `save config`

#### Procedure for R80.40 and R81 - Security Gateways / Management Servers / Log Servers that run Gaia OS

Show / Hide this section  
1. Connect to the command line on the appliance.

2. Log in to the Expert mode.

3. Get the list of the currently enabled ciphers and paste it into a plain-text editor (like Notepad++) on your computer:

   `sshd -T -C addr=localhost | grep -i ciphers`
4. On your computer, in the plain-text editor, edit the list of the enabled ciphers to remove the unwanted ciphers.

   **Important Note** - If you do not see the unwanted cipher in this list, then your Gaia OS is not vulnerable. Stop the procedure.

   Example:
   * Before:

     `ciphers `chacha20-poly1305@openssh.com`,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com`
   * After:

     `ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com`
5. Back up the current SSH configuration file:

   * R81, or R80.40 Jumbo Hotfix Take 83 and higher:

     `cp -v /etc/ssh/templates/sshd_config.templ{,_BKP}`
   * R80.40, or R80.40 Jumbo Hotfix Take 78 and lower:

     `cp -v /etc/ssh/sshd_config{,_BKP}`
6. Edit the current SSH configuration file:

   * R81, or R80.40 Jumbo Hotfix Take 83 and higher:

     `vi /etc/ssh/templates/sshd_config.templ`
   * R80.40, or R80.40 Jumbo Hotfix Take 78 and lower:

     `vi /etc/ssh/sshd_config`
7. Look for the "**ciphers**" line.

   Example:

   `ciphers 3des-cbc,blowfish-cbc,cast128-cbc,aes128-cbc,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com`
8. If this "**ciphers** " line exists in the SSH configuration file, then delete the current line and paste the modified "**ciphers**" line from your computer from the plain-text editor.

9. If this "**ciphers** " line does not exist in the SSH configuration file, then paste the modified "**ciphers** " line from your computer from the plain-text editor **above** the line "**Match address**".

10. Save the changes in the file, and exit Vi editor.

11. On R81, or R80.40 Jumbo Hotfix Take 83 and higher:

    Run this command:

    `/bin/sshd_template_xlate < /config/active`
12. Restart the SSH server:

    `service sshd restart`

#### Procedure for R81 Scalable Platforms (Maestro and Chassis)

Show / Hide this section  
1. Connect to the command line on the Security Group.

2. If your default shell is Gaia gClish, then go to the Expert mode:

   `expert`
3. Get the list of the currently enabled ciphers and paste it into a plain-text editor (like Notepad++) on your computer:

   `sshd -T -C addr=localhost | grep -i ciphers`
4. On your computer, in the plain-text editor, edit the list of the enabled ciphers to remove the unwanted ciphers.

   **Important Note** - If you do not see the unwanted cipher in this list, then your Gaia OS is not vulnerable. Stop the procedure.

   Example:
   * Before:

     `ciphers `chacha20-poly1305@openssh.com`,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com`
   * After:

     `ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com`
5. Back up the current SSH configuration file:

   `g_all cp -v /etc/ssh/sshd_config{,_BKP}`
6. Edit the current SSH configuration file:

   `vi /etc/ssh/sshd_config`
7. Look for the "**ciphers**" line.

   Example:

   `ciphers 3des-cbc,blowfish-cbc,cast128-cbc,aes128-cbc,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com`
8. If this "**ciphers** " line exists in the SSH configuration file, then delete the current line and paste the modified "**ciphers**" line from your computer from the plain-text editor.

9. If this "**ciphers** " line does not exist in the SSH configuration file, then paste the modified "**ciphers** " line from your computer from the plain-text editor **above** the line "**Match address**".

10. Save the changes in the file, and exit Vi editor.

11. Copy the modified file to all Security Group Members:

    `asg_cp2blades -b all /etc/ssh/sshd_config`
12. Restart the SSH server:

    `g_all service sshd restart`

### Additional Notes

Show / Hide this section  
* You can add to the list, or remove from the list, any weak Cipher, MAC, or Kex.
* Vulnerability is also applicable to CBC ciphers   
  Example: ciphers 3des-cbc,blowfish-cbc,cast128-cbc,aes128-cbc,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se
* In order to pass the vulnerability scan, we need to remove not only chacha20 but also cbc ciphers.https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-48795

<!-- -->

* To make sure you applied the changes correctly, run the applicable command and examine the list:

  * To see the Ciphers:

    `sshd -T -C addr=localhost | grep -w ciphers`
  * To see the MAC values:

    `sshd -T -C addr=localhost | grep -w macs`
  * To see the Kex values:

    `sshd -T -C addr=localhost | grep -w kexalgorithms`

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content