Disabling versions of the SSL/TLS protocols that support cipher suites which use 3DES as the symmetric encryption cipher in Service Bus

Sanjeev Sirigere 0

Hello,

I got a Critical Vulnerabilities reported against the Service Bus I have provisioned in our Azure subscription with following details. Please note, I have my Service Bus Namespace configured at Minimum TLS version of 1.2 (Service Bus Namespace > Settings > Configuration)

xyz-pre-ncus.servicebus.windows.net

xyz-prod-ncus.servicebus.windows.net

Each of these addresses have been flagged for:

Vulnerability Title: TLS/SSLBirthday attacks on 64-bit block ciphers (SWEET32)

Vulnerability Description:

 Legacy block ciphers having a block size of 64 bits are vulnerable to a practical collision attack when used in CBC mode. All versions of the SSL/TLS protocols that support cipher suites which use 3DES as the symmetric encryption cipher are affected. The security of a block cipher is often reduced to the key size k: the best attack should be the exhaustive search of the key, with complexity 2 to the power of k. However, the block size n is also an important security parameter, defining the amount of data that can be encrypted under the same key. This is particularly important when using common modes of operation: we require block ciphers to be secure with up to 2 to the power of n queries, but most modes of operation (e.g. CBC, CTR, GCM, OCB, etc.) are unsafe with more than 2 to the power of half n blocks of message (the birthday bound). With a modern block cipher with 128-bit blocks such as AES, the birthday bound corresponds to 256 exabytes. However, for a block cipher with 64-bit blocks, the birthday bound corresponds to only 32 GB, which is easily reached in practice. Once a collision between two cipher blocks occurs it is possible to use the collision to extract the plain text data.

Vulnerability Title: TLS Server Supports TLS version 1.0

Vulnerability Description: The PCI (Payment Card Industry) Data Security Standard requires a minimum of TLS v1.1 and recommends TLS v1.2. In addition, FIPS 140-2 standard requires a minimum of TLS v1.1 and recommends TLS v1.2.

Solution provided:

Solution Summary: Disable TLS/SSL support for 3DES cipher suite

Solution: Configure the server to disable support for 3DES suite.For Microsoft IIS web servers, see Microsoft Knowledgebase article (Transport Layer Security (TLS) registry settings ) for instructions on configuring cipher suites. To achieve a higher level of security, one may refer to authoritative sources/guides (Security/Server Side TLS - MozillaWiki ) as well as server vendor documentation to apply an informed cipher configuration.

Solution Summary: Disable insecure TLS/SSL protocol support

Solution: Configure the server to require clients to use TLS version 1.2 using Authenticated Encryption with Associated Data (AEAD) capable ciphers.

Please let me know how I can configure to remove 3DES cipher.

Thanks

Gursimran Singh 570 Reputation points Microsoft External Staff Moderator

2026-08-12T23:58:44.6+00:00

Hi @Sanjeev Sirigere ,

Thank you for sharing the scan results.

Azure Service Bus is a Microsoft-managed service and does not provide a customer-facing option to enable or disable specific TLS cipher suites such as 3DES. Customers can configure the minimum TLS version for the namespace, which you have already set to TLS 1.2. [Use approv...ervice Bus | SharePoint], [learn.microsoft.com]

Reviewing the Nmap output you provided, the endpoint advertises only AES-based TLS 1.2 and TLS 1.3 cipher suites. We do not see any 3DES cipher suite (for example, TLS_RSA_WITH_3DES_EDE_CBC_SHA) in the reported list. Based on this output, the endpoint does not appear to support 3DES. [Disabling...rosoft Q&A | Learn.Microsoft.com]

If a vulnerability scanner is still reporting SWEET32 or TLS 1.0 support, it may be a scanner interpretation issue. Microsoft documentation notes that Service Bus enforces the configured minimum TLS version at the namespace level, and requests using versions lower than the configured minimum are rejected. [Use approv...ervice Bus | SharePoint], [Disabling...rosoft Q&A | Learn.Microsoft.com]

We recommend providing the scanner vendor with the Nmap results and requesting validation of the finding. If you can share the complete scan report, we can review it further and help determine whether the finding is a false positive.

6 answers

Gursimran Singh 570 Reputation points Microsoft External Staff Moderator

2026-08-20T18:42:41.7766667+00:00

Hi @Sanjeev Sirigere ,

Yes. Based on the Nmap ssl-enum-ciphers output you shared, the Service Bus endpoint advertises only AES-based TLS 1.2 and TLS 1.3 cipher suites. No 3DES cipher suites are present in the supported cipher list. Therefore, the endpoint does not appear to support 3DES and the reported SWEET32 vulnerability is likely a false positive.

Additionally, Azure Service Bus is a Microsoft-managed service and customers cannot directly configure or disable individual cipher suites. The configurable security setting available to customers is the minimum TLS version, and your namespace is already configured to require TLS 1.2. [https://le...urce=docs)])

We recommend reviewing the finding with the vulnerability scanner vendor and providing the Nmap cipher enumeration results for validation, as the observed TLS handshake does not show any 3DES support.
Was this answer helpful?

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Disabling versions of the SSL/TLS protocols that support cipher suites which use 3DES as the symmetric encryption cipher in Service Bus

6 answers

Your answer