STIGQter: STIG Summary: Oracle MySQL 8.0 Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Jan 2021:

The MySQL Database Server 8.0 must implement NIST FIPS 140-2 validated cryptographic modules to generate and validate cryptographic hashes.

DISA Rule

SV-235189r638812_rule

Vulnerability Number

V-235189

Group Title

SRG-APP-000514-DB-000382

Rule Version

MYS8-00-011700

Severity

CAT I

CCI(s)

• CCI-002450 - The information system implements organization-defined cryptographic uses and type of cryptography required for each use in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.

Weight

10

Fix Recommendation

Implement NIST FIPS 140-2 validated cryptographic modules to provision digital signatures.

Turn on MySQL FIPS mode and restart mysqld
Edit my.cnf
[mysqld]
ssl_fips_mode=ON

or
[mysqld]
ssl_fips_mode=STRICT

In general, STRICT imposes more restrictions than ON, but MySQL itself has no FIPS-specific code other than to specify to OpenSSL the FIPS mode value. The exact behavior of FIPS mode for ON or STRICT depends on the OpenSSL version.

Check Contents

ALL cryptography is provided via OpenSSL and can be verified in FIPS mode.

Run this command:
SELECT VARIABLE_NAME, VARIABLE_VALUE
FROM performance_schema.global_variables where variable_name = 'ssl_fips_mode';

If the VARIABLE_VALUE does not return "ON" or "STRICT", this is a finding.

In general, STRICT imposes more restrictions than ON, but MySQL itself has no FIPS-specific code other than to specify to OpenSSL the FIPS mode value. The exact behavior of FIPS mode for ON or STRICT depends on the OpenSSL version.

Vulnerability Number

V-235189

Documentable

False

Rule Version

MYS8-00-011700

Severity Override Guidance

ALL cryptography is provided via OpenSSL and can be verified in FIPS mode.

Run this command:
SELECT VARIABLE_NAME, VARIABLE_VALUE
FROM performance_schema.global_variables where variable_name = 'ssl_fips_mode';

If the VARIABLE_VALUE does not return "ON" or "STRICT", this is a finding.

In general, STRICT imposes more restrictions than ON, but MySQL itself has no FIPS-specific code other than to specify to OpenSSL the FIPS mode value. The exact behavior of FIPS mode for ON or STRICT depends on the OpenSSL version.

Check Content Reference

M

Target Key

5277

Comments