Fix for CVE-2016-2183 in FIPS mode

Fixes #334

Author: silug

CHANGELOG

@@ -1,3 +1,6 @@
+* Wed Jan 07 2026 Steven Pritchard <steve@sicura.us> - 5.0.1
+- Fix for CVE-2016-2183 in FIPS mode (#334)
+
 * Tue Nov 25 2025 Steven Pritchard <steve@sicura.us> - 5.0.0
 - Make the various `assert` functions non-fatal by default
 

lib/facter/fips_ciphers.rb

@@ -1,10 +1,17 @@
 # List available FIPS-compatible OpenSSL ciphers on the system
+# Excludes weak ciphers vulnerable to CVE-2016-2183 (SWEET32)
 # Returns: Array[String]
 Facter.add('fips_ciphers') do
   confine kernel: 'Linux'
   openssl_bin = Facter::Core::Execution.which('openssl')
 
   setcode do
-    Facter::Core::Execution.exec("#{openssl_bin} ciphers FIPS:-LOW").split(':') if openssl_bin
+    # Exclude 3DES and other weak ciphers:
+    # - 3DES (vulnerable to SWEET32/CVE-2016-2183)
+    # - LOW (weak encryption)
+    # - NULL (no encryption)
+    # - EXPORT (weak export-grade)
+    # - anon (anonymous, no authentication)
+    Facter::Core::Execution.exec("#{openssl_bin} ciphers 'FIPS:-3DES:-LOW:-NULL:-EXPORT:-aNULL'").split(':') if openssl_bin
   end
 end

metadata.json

@@ -1,6 +1,6 @@
 {
   "name": "simp-simplib",
-  "version": "5.0.0",
+  "version": "5.0.1",
   "author": "SIMP Team",
   "summary": "A collection of common SIMP functions, facts, and types",
   "license": "Apache-2.0",

spec/unit/facter/fips_ciphers_spec.rb

@@ -9,7 +9,7 @@
   context 'openssl command exists' do
     it 'returns FIPS ciphers' do
       expect(Facter::Core::Execution).to receive(:which).with('openssl').and_return('/bin/openssl')
-      expect(Facter::Core::Execution).to receive(:exec).with('/bin/openssl ciphers FIPS:-LOW')
+      expect(Facter::Core::Execution).to receive(:exec).with("/bin/openssl ciphers 'FIPS:-3DES:-LOW:-NULL:-EXPORT:-aNULL'")
                                                        .and_return('ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA')
       expect(Facter.fact('fips_ciphers').value).to eq(['ECDHE-RSA-AES256-GCM-SHA384', 'ECDHE-ECDSA-AES256-GCM-SHA384', 'ECDHE-RSA-AES256-SHA384', 'ECDHE-ECDSA-AES256-SHA384', 'ECDHE-RSA-AES256-SHA'])
     end