V-235187
Oracle MySQL 8.0 Security Technical Implementation Guide
Title
The MySQL Database Server 8.0 must use NSA-approved cryptography to protect classified information in accordance with the data owner's requirements.
Description
<VulnDiscussion>Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The application must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated. It is the responsibility of the data owner to assess the cryptography requirements in light of applicable federal laws, Executive Orders, directives, policies, regulations, and standar...
Fix Text (Documentation Requirement)
Configure cryptographic functions to use NSA-approved cryptography-compliant algorithms. Turn on MySQL FIPS mode. Edit my.cnf [mysqld] ssl_fips_mode=ON or [mysqld] ssl_fips_mode=STRICT To restrict TLS versions: [mysqld] tls_version='TLSv1.2,TLSv1.3' Example to define ciphers for TLSv1.2: [mysqld] ssl_ciphers='ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305' If TLSv1.3 is enabled, the "tls_ciphersuites" setting must contain all or a subset of the following ciphers based on certificates being used by server and client. Enabling FIPS mode will limit the OpenSS...