BugZero | Cisco BugID CSCvq10907 - SSH Cipher and MAC configuration is not applied to...

Loading...

Operational Defect Database

A free repository of operational (non-security) bugs centralized through custom integrations with leading IT vendors.

Product

Enterprise platform
Bug Scrub Advisor
Operational Risk Scoring
Vendor Integrations

Company

Plans
Value Guide
About
Contact us

Resources

Blog
ServiceNow App
Trust Center
Risk Management
NIST
DORA

Operational Defect Database

A free repository of operational (non-security) bugs centralized through custom integrations with leading IT vendors.

Product

Enterprise platform
Bug Scrub Advisor
Operational Risk Scoring
Vendor Integrations

Company

Plans
Value Guide
About
Contact us

Resources

Blog
ServiceNow App
Trust Center
Risk Management
NIST
DORA

©2025 BugZero. All Rights Reserved.

Privacy Policy Terms of Service

BugZero | Cisco BugID CSCvq10907 - SSH Cipher and MAC configuration is not applied to...

ODD
Cisco
CSCvq10907

Cisco - Defect ID: CSCvq10907

SSH Cipher and MAC configuration is not applied to switches

ODD
Cisco
CSCvq10907

Cisco - Defect ID: CSCvq10907

SSH Cipher and MAC configuration is not applied to switches

Last updated on July 1st, 2022

BugZero Risk Score
6.0 Medium

Overall: 6.0

Severity: 6.4

Lifecycle: 9.1

Popularity: 3.7

What is the BugZero Risk Score?

Cisco Integration

Learn more about where this data comes from

Cisco Integration

Bug Scrub Advisor

Streamline upgrades with automated vendor bug scrubs

Bug Scrub Advisor

BugZero Enterprise

Wish you caught this bug sooner? Get proactive today.

BugZero Enterprise

Bug Details

Views: 7

Description

Symptom

Changes to SSH parameters, such as SSH cipher and MAC algorithms, are not reflected on the switch.

Conditions

None.

Workaround

None.

Further Problem Description

1. When I remove hmac-sha1 MAC selection in Fabirc Policies - Policies - Pod - Management Access - default from the policy, I can see that configuration is applied on APIC: 2. When I test the connection to APIC, I can see that it's not allowed with hmac-sha1: ssh -l admin@APIC-IP -m hmac-sha1 Unable to negotiate. No matching MAC found 3. At the same time, I don't see any configuration changes for SSH on switches. 4. And when I login to a switch via SSH, with hmac-sha1 MAC, it's allowed.

Change history

2022-07-01 Added: 13.2(6i)

Relevant Products

Click on a version to see all relevant bugs

Affected versions:13.2(6i)

Fixed versions: 11.1(1j), 11.1(1o), 11.1(1r), 11.1(1s), 11.1(2h), 11.1(2i), 11.1(3f), 11.1(4e), 11.1(4f), 11.1(4g), 11.1(4i), 11.1(4l), 11.1(4m), 11.2(1i), 11.2(1k), 11.2(1m), 11.2(2g), 11.2(2h), 11.2(2i), 11.2(2j), 11.2(3c), 11.2(3e), 11.2(3h), 11.2(3m), 11.3(1g), 11.3(1h), 11.3(1i), 11.3(1j), 11.3(2f), 11.3(2h), 11.3(2i), 11.3(2j), 11.3(2k), 12.0(1m), 12.0(1n), 12.0(1o), 12.0(1p), 12.0(1q), 12.0(2f), 12.0(2g), 12.0(2h), 12.0(2l), 12.0(2m), 12.0(2n), 12.0(2o), 12.1(1h), 12.1(1i), 12.1(2e), 12.1(2g), 12.1(2k), 12.1(3g), 12.1(3h), 12.1(3j), 12.1(4a), 12.2(1k), 12.2(1n), 12.2(1o), 12.2(2e), 12.2(2f), 12.2(2i), 12.2(2j), 12.2(2k), 12.2(2q), 12.2(3j), 12.2(3p), 12.2(3r), 12.2(3s), 12.2(3t), 12.2(4f), 12.2(4p), 12.2(4q), 12.2(4r), 12.3(1e), 12.3(1f), 12.3(1i), 12.3(1l), 12.3(1o), 12.3(1p), 13.0(1k), 13.0(2h), 13.0(2k), 13.0(2n), 13.1(1i), 13.1(2m), 13.1(2o), 13.1(2p), 13.1(2q), 13.1(2s), 13.1(2t), 13.1(2u), 13.1(2v), 13.2(1l), 13.2(1m), 13.2(2l), 13.2(2o), 13.2(3i), 13.2(3n), 13.2(3o), 13.2(3r), 13.2(3s), 13.2(4d), 13.2(4e), 14.0(3c), 14.0(3d), 14.2(1i)

Relevant Products

Click on a version to see all relevant bugs

Affected versions:13.2(6i)

Fixed versions: 11.1(1j), 11.1(1o), 11.1(1r), 11.1(1s), 11.1(2h), 11.1(2i), 11.1(3f), 11.1(4e), 11.1(4f), 11.1(4g), 11.1(4i), 11.1(4l), 11.1(4m), 11.2(1i), 11.2(1k), 11.2(1m), 11.2(2g), 11.2(2h), 11.2(2i), 11.2(2j), 11.2(3c), 11.2(3e), 11.2(3h), 11.2(3m), 11.3(1g), 11.3(1h), 11.3(1i), 11.3(1j), 11.3(2f), 11.3(2h), 11.3(2i), 11.3(2j), 11.3(2k), 12.0(1m), 12.0(1n), 12.0(1o), 12.0(1p), 12.0(1q), 12.0(2f), 12.0(2g), 12.0(2h), 12.0(2l), 12.0(2m), 12.0(2n), 12.0(2o), 12.1(1h), 12.1(1i), 12.1(2e), 12.1(2g), 12.1(2k), 12.1(3g), 12.1(3h), 12.1(3j), 12.1(4a), 12.2(1k), 12.2(1n), 12.2(1o), 12.2(2e), 12.2(2f), 12.2(2i), 12.2(2j), 12.2(2k), 12.2(2q), 12.2(3j), 12.2(3p), 12.2(3r), 12.2(3s), 12.2(3t), 12.2(4f), 12.2(4p), 12.2(4q), 12.2(4r), 12.3(1e), 12.3(1f), 12.3(1i), 12.3(1l), 12.3(1o), 12.3(1p), 13.0(1k), 13.0(2h), 13.0(2k), 13.0(2n), 13.1(1i), 13.1(2m), 13.1(2o), 13.1(2p), 13.1(2q), 13.1(2s), 13.1(2t), 13.1(2u), 13.1(2v), 13.2(1l), 13.2(1m), 13.2(2l), 13.2(2o), 13.2(3i), 13.2(3n), 13.2(3o), 13.2(3r), 13.2(3s), 13.2(4d), 13.2(4e), 14.0(3c), 14.0(3d), 14.2(1i)

Top Cisco Defects

9.7Defect ID: CSCvd48893
Cisco IOS and IOS XE Software Cluster Management Protocol Remote Code Execution Vulnerability
9.7Defect ID: CSCvv15096
9200L: SYS-3-CPUHOG: Task is running for (2843)msecs, more than (2000)msecs process = SAUtilReport.
9.7Defect ID: CSCwe01579
Cat9800 wncd reload while creating an RRM Client Coverage on large scale setup
9.7Defect ID: CSCwc66646
Unexpected Reload due to Segmentation Fault in the CCSIP_SPI_CONTROL process
9.7Defect ID: CSCwf08698
Cat9k Crashes Unexpectedly due to a Fault in the 'TLSCLIENT_PROCESS'

Ready to prevent the next vendor outage?

Links

Original Vendor Announcement

Cisco Integration

Learn more about where this data comes from

Cisco Integration

Bug Scrub Advisor

Streamline upgrades with automated vendor bug scrubs

Bug Scrub Advisor

BugZero Enterprise

Wish you caught this bug sooner? Get proactive today.

BugZero Enterprise