We did a Qualys test on two of our URLs earlier today. The URLs are of two similar applications (same versions) hosted on identical servers located at two different datacenters. The test returned 'A-' for one and 'F' for the other. The reason for 'F' rating was given as:
This server is vulnerable to the OpenSSL Padding Oracle vulnerability (CVE-2016-2107) and insecure. Grade set to F.
However, the version of
OpenSSL we have on both the servers are old and identical:
[user@alpha01 ~]$ rpm -qa | grep openssl openssl-1.0.1e-30.el6_6.4.x86_64
Why did the Qualys test not identify the vulnerability on the server that it gave 'A-' though it is running a vulnerable version of
OpenSSL as the other? Is OpenSSL Padding Oracle vulnerability something that can be fixed at the firewall level? I suspect the firewall at the server that received the 'A-' was successful in filtering out the packet that was trying to test this vulnerability. Am I right? Is this something that can be fixed at the firewall level? (Since both the webservers are located at different data-centers and behind different firewalls)