[MDEV-19542] Disable SSLv3 and TLSv1.0 Created: 2019-05-21 Updated: 2019-12-23 Resolved: 2019-09-14 |
|
| Status: | Closed |
| Project: | MariaDB Server |
| Component/s: | SSL |
| Fix Version/s: | 10.4.6 |
| Type: | Task | Priority: | Major |
| Reporter: | Geoff Montee (Inactive) | Assignee: | Sergei Golubchik |
| Resolution: | Fixed | Votes: | 0 |
| Labels: | None | ||
| Issue Links: |
|
||||||||||||||||||||||||||||
| Description |
|
The latest PCI DSS Requirements recommend only using TLSv1.1 and above. MariaDB does not follow these recommendations. It looks like MariaDB can still use SSLv3 and TLSv1.0 if the server is linked with yaSSL, and MariaDB still use TLSv1.0 if the server is linked with OpenSSL. Should we disable support for SSLv3 and TLSv1.0? yaSSL only supports up to TLSv1.1, so we would probably need to replace yaSSL before we can do this. See If we make this change, then we should also update the documentation: https://mariadb.com/kb/en/library/secure-connections-overview/#tls-protocol-version-support |
| Comments |
| Comment by Geoff Montee (Inactive) [ 2019-09-12 ] |
|
The default value of tls_version in 10.4.6 and later is "TLSv1.1,TLSv1.2,TLSv1.3". This was implemented in https://mariadb.com/kb/en/library/ssltls-system-variables/#tls_version Should this Jira be closed with "Fix Version/s" set to 10.4.6? |
| Comment by Sergei Golubchik [ 2019-09-14 ] |
|
Yes, thanks! |