Hi Tim

Please note that the CVE numbers that are listed are specific to other products running on the same port as the pdf service or which are vulnerable to the TLS ROBOT vulnerability, and are not directly associated with the K2 product. 

The TLS ROBOT vulnerability is present whenever TLS_RSA* cipher suites are available for encryption on an endpoint or service (More info: https://www.robotattack.org/)
K2 does not directly interact with the TLS protocol and relies on the underlying operating system's configuration and TLS negotiation, which means that instead of the pdf service being directly vulnerable, it is more related to the Windows Server it is running on and the windows configuration that is allowing TLS_RSA* cipher suites to be used. 

The PDF service is an internal service and does not require access from the internet which reduced the risk significantly, and actually doesn't need to be exposed to the rest of your network because calls are made from the K2 Host Server service directly to the PDF service which is on the same machine...
For this reason, the simplest mitigation is to block incoming traffic to port 5630 on your windows firewall. 
The most complete mitigation would be to disable all TLS_RSA* cipher suites on the windows server using the Disable-TlsCiphersuite powershell commands
https://docs.microsoft.com/en-us/powershell/module/tls/disable-tlsciphersuite?view=windowsserver2022-ps
Please note however that this affects all services running on the server and great care should be taken when doing so. 

Just as a last note - The KB article that was shared in your original post would have no effect to prevent TLS ROBOT and is to restrict what sites/endpoints the PDF service can connect to and does not prevent other services/addresses to connect to it - The configuration restricts outbound communication, not inbound. 

Hope this helps