V-235138
Oracle MySQL 8.0 Security Technical Implementation Guide
Title
If passwords are used for authentication, the MySQL Database Server 8.0 must store only hashed, salted representations of passwords.
Description
<VulnDiscussion>The DOD standard for authentication is DOD-approved PKI certificates. Authentication based on User ID and Password may be used only when it is not possible to employ a PKI certificate, and requires Authorizing Official (AO) approval. In such cases, database passwords stored in clear text, using reversible encryption, or using unsalted hashes would be vulnerable to unauthorized disclosure. Database passwords must always be in the form of one-way, salted hashes when stored intern...
Fix Text (Documentation Requirement)
Develop, document, and maintain a list of DBMS database objects, database configuration files, associated scripts, and applications defined within or external to the DBMS that access the database, and DBMS/user environment files/settings in the System Security Plan. Record whether they do or do not contain DBMS passwords. If passwords are present, ensure they are encoded or encrypted and protected by host system security. Where possible, alter the authentication mode to X509 or LDAP SASL/Kerberos: Just X509 certificate - for example ALTER USER 'jeffrey'@'localhost' REQUIRE X509; Specific X509 example: ALTER USER 'jeffrey'@'localhost' REQUIRE SUBJECT '/C=SE/ST=Stockholm/L=Stockholm/ O=MySQL demo client certificate/ CN=client/emailAddress=client@example.com' AND ISSUER '/C=SE/...