Details
-
New Feature
-
Status: Open (View Workflow)
-
Critical
-
Resolution: Unresolved
Description
In MySQL 5.6 and 5.7, you have the option of using the SHA256 password algorithm. The current method (mysql_native_password) leverages SHA1 and this has been proven to be no longer as secure as one would expect today.
Find out more here:
- http://mysqlblog.fivefarmers.com/2015/08/31/protecting-mysql-passwords-with-sha256_password-plugin/
- https://dev.mysql.com/doc/refman/5.7/en/sha256-authentication-plugin.html
UPDATE:
https://dev.mysql.com/doc/mysql-security-excerpt/8.0/en/sha256-pluggable-authentication.html
Attachments
Issue Links
- is duplicated by
-
-
- Closed
-
- is part of
-
MDEV-28906 MySQL 8.0 desired compatibility
-
- Open
-
- relates to
-
-
- Closed
-
-
-
- Closed
-
-
-
- Closed
-
-
-
- Closed
-
-
-
- Closed
-
-
-
- Closed
-
-
-
- Closed
-
-
-
- Closed
-
-
-
- Closed
-
-
-
- Closed
-
Activity
| Field | Original Value | New Value |
|---|---|---|
| Summary | FR: sha256_password plugin | sha256_password plugin |
| Priority | Major [ 3 ] | Critical [ 2 ] |
| Fix Version/s | 10.1 [ 16100 ] |
| Assignee | Sergei Golubchik [ serg ] |
| Fix Version/s | 10.2 [ 14601 ] | |
| Fix Version/s | 10.1 [ 16100 ] |
| Priority | Critical [ 2 ] | Major [ 3 ] |
| Comment | [ SHA256 in MySQL is still SHA1, it doesn't offer any better security on top of SHA1. ] |
| Priority | Major [ 3 ] | Minor [ 4 ] |
| Link |
This issue relates to |
| Link | This issue blocks CONJ-328 [ CONJ-328 ] |
| Assignee | Sergei Golubchik [ serg ] | Georg Richter [ georg ] |
| Component/s | Authentication and Privilege System [ 13101 ] |
| Workflow | MariaDB v3 [ 74672 ] | MariaDB v4 [ 130455 ] |
| Fix Version/s | N/A [ 14700 ] | |
| Fix Version/s | 10.2 [ 14601 ] | |
| Priority | Minor [ 4 ] | Major [ 3 ] |
| Labels | compat80 |
| Link | This issue is part of MDEV-28906 [ MDEV-28906 ] |
| Description |
In MySQL 5.6 and 5.7, you have the option of using the SHA256 password algorithm. The current method (mysql_native_password) leverages SHA1 and this has been proven to be no longer as secure as one would expect today.
Find out more here: * http://mysqlblog.fivefarmers.com/2015/08/31/protecting-mysql-passwords-with-sha256_password-plugin/ * https://dev.mysql.com/doc/refman/5.7/en/sha256-authentication-plugin.html |
In MySQL 5.6 and 5.7, you have the option of using the SHA256 password algorithm. The current method (mysql_native_password) leverages SHA1 and this has been proven to be no longer as secure as one would expect today. Find out more here: * http://mysqlblog.fivefarmers.com/2015/08/31/protecting-mysql-passwords-with-sha256\_password\-plugin/ * https://dev.mysql.com/doc/refman/5.7/en/sha256-authentication-plugin.html |
| Fix Version/s | N/A [ 14700 ] |
| Assignee | Georg Richter [ georg ] | Sergei Golubchik [ serg ] |
| Summary | sha256_password plugin | Implement a sha256_password / caching_sha256_password plugin |
| Fix Version/s | 10.13 [ 28501 ] |
| Fix Version/s | 11.1 [ 28549 ] |
| Fix Version/s | 10.13 [ 28501 ] |
| Priority | Major [ 3 ] | Critical [ 2 ] |
| Priority | Critical [ 2 ] | Major [ 3 ] |
| Assignee | Sergei Golubchik [ serg ] | Stefan Schmit [ JIRAUSER52595 ] |
| Status | Open [ 1 ] | Needs Feedback [ 10501 ] |
| Fix Version/s | N/A [ 14700 ] | |
| Fix Version/s | 11.1 [ 28549 ] | |
| Resolution | Incomplete [ 4 ] | |
| Status | Needs Feedback [ 10501 ] | Closed [ 6 ] |
| Assignee | Stefan Schmit [ JIRAUSER52595 ] | |
| Resolution | Incomplete [ 4 ] | |
| Status | Closed [ 6 ] | Stalled [ 10000 ] |
| Status | Stalled [ 10000 ] | Open [ 1 ] |
| Zendesk Related Tickets | 105939 174215 154940 |
| Issue Type | Task [ 3 ] | New Feature [ 2 ] |
| Fix Version/s | 12.1 [ 29992 ] | |
| Fix Version/s | N/A [ 14700 ] |
| Assignee | Sergei Golubchik [ serg ] |
| Priority | Major [ 3 ] | Critical [ 2 ] |
| Link |
This issue is duplicated by |
| Summary | Implement a sha256_password / caching_sha256_password plugin | Implement a caching_sha256_password plugin |
| Description |
In MySQL 5.6 and 5.7, you have the option of using the SHA256 password algorithm. The current method (mysql_native_password) leverages SHA1 and this has been proven to be no longer as secure as one would expect today. Find out more here: * http://mysqlblog.fivefarmers.com/2015/08/31/protecting-mysql-passwords-with-sha256\_password\-plugin/ * https://dev.mysql.com/doc/refman/5.7/en/sha256-authentication-plugin.html |
In MySQL 5.6 and 5.7, you have the option of using the SHA256 password algorithm. The current method (mysql_native_password) leverages SHA1 and this has been proven to be no longer as secure as one would expect today.
Find out more here: * http://mysqlblog.fivefarmers.com/2015/08/31/protecting-mysql-passwords-with-sha256\_password\-plugin/ * https://dev.mysql.com/doc/refman/5.7/en/sha256-authentication-plugin.html *UPDATE*: https://dev.mysql.com/doc/mysql-security-excerpt/8.0/en/sha256-pluggable-authentication.html |