STIGQter: STIG Summary: Oracle MySQL 8.0 Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

The MySQL Database Server 8.0 must use NIST FIPS 140-2 or 140-3 validated cryptographic modules for cryptographic operations.

DISA Rule

SV-235148r961050_rule

Vulnerability Number

V-235148

Group Title

SRG-APP-000179-DB-000114

Rule Version

MYS8-00-006200

Severity

CAT I

CCI(s)

• CCI-000803 - Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.

Weight

10

Fix Recommendation

Utilize NIST FIPS validated cryptographic modules for all cryptographic operations.
See Use MySQL Server OpenSSL FIPS mode. See https://dev.mysql.com/doc/refman/8.0/en/fips-mode.html

Turn on MySQL FIPS mode and restart mysqld
Edit my.cnf
[mysqld]
ssl_fips_mode=ON

or
[mysqld]
ssl_fips_mode=STRICT

ON: Enable FIPS mode.
STRICT: Enable “strict” FIPS mode.

Check Contents

Review DBMS configuration to verify it is using NIST FIPS validated cryptographic modules for cryptographic operations.

To check for FIPS validated cryptographic modules for all operations, run this script in the database:
SELECT VARIABLE_NAME, VARIABLE_VALUE
FROM performance_schema.global_variables where variable_name = 'ssl_fips_mode';

The result will be either "ON" or "STRICT". If not, then NIST FIPS validated modules are not being used, and this is a finding.

Vulnerability Number

V-235148

Documentable

False

Rule Version

MYS8-00-006200

Severity Override Guidance

Review DBMS configuration to verify it is using NIST FIPS validated cryptographic modules for cryptographic operations.

To check for FIPS validated cryptographic modules for all operations, run this script in the database:
SELECT VARIABLE_NAME, VARIABLE_VALUE
FROM performance_schema.global_variables where variable_name = 'ssl_fips_mode';

The result will be either "ON" or "STRICT". If not, then NIST FIPS validated modules are not being used, and this is a finding.

Check Content Reference

M

Target Key

5277