Description
This article explains why the CVE-2022-40735 is not a security issue.
Scope
FortiGate.
Solution
CVE-2022-40735 is a variant of CVE-2002-20001 which is well known property of DHE that it's more computationally intensive than RSA and ECDHE key exchanges. In addition to that, OpenSSL and many other vendors do not even consider this a security issue as stated in Stop recommending DHE, because of "dheater" vulnerability :CVE-2002-20001 #17374 and Stop recommending DHE, because of "dheater" vulnerability #162.
However, to disable the use of DHE in FortiOS v7.0.2 onwards, it is possible to use the below commands:
config system global
set admin-https-ssl-banned-ciphers DHE
end
To disable the use of DHE in SSL VPN, use the below commands:
config vpn ssl settings
set banned-cipher DHE
end
