Sweet32

"This server is vulnerable to a SWEET32 attack. Make sure the weak ciphers (DES and 3DES) are disabled on the server and use AES."

The Sweet32 Birthday attack, affects the triple-DES cipher. Although the OpenSSL team rated the triple-DES vulnerability as low, they stated “triple-DES should now be considered as ‘bad’ as RC4.” DigiCert security experts, as well as other security professionals, recommend disabling any triple-DES cipher on your servers.

The DES ciphers (and triple-DES) only have a 64-bit block size. This enables an attacker to run JavaScript in a browser and send large amounts of traffic during the same TLS connection, creating a collision. With this collision, the attacker is able to retrieve information from a session cookie.

The triple-DES cipher is supported by a vast majority of HTTPS servers and all major web browsers—around 600 of the most-visited websites. Fortunately, most browsers opt to use AES rather than triple-DES when making an HTTPS connection.

Use one of these solutions:

• Disable any triple-DES cipher on servers that still support it.
• Upgrade old servers that don't support stronger ciphers than DES or RC4.