STIGQter STIGQter: STIG Summary: Tri-Lab Operating System Stack (TOSS) 4 Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

The TOSS operating system must implement DOD-approved TLS encryption in the GnuTLS package.

DISA Rule

SV-252925r1190838_rule

Vulnerability Number

V-252925

Group Title

SRG-OS-000250-GPOS-00093

Rule Version

TOSS-04-010150

Severity

CAT I

CCI(s)

Weight

10

Fix Recommendation

Configure the TOSS GnuTLS library to use only DOD-approved encryption by adding the following line to "/etc/crypto-policies/back-ends/gnutls.config":

+VERS-ALL:-VERS-DTLS0.9:-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1:-VERS-DTLS1.0

A reboot is required for the changes to take effect.

Check Contents

Verify the GnuTLS library is configured to only allow DOD-approved SSL/TLS Versions:

$ sudo grep -io +vers.* /etc/crypto-policies/back-ends/gnutls.config

+VERS-ALL:-VERS-DTLS0.9:-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1:-VERS-DTLS1.0:+COMP-NULL:%PROFILE_MEDIUM

If the "gnutls.config" does not list "-VERS-DTLS0.9:-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1:-VERS-DTLS1.0" to disable unapproved SSL/TLS versions, this is a finding.

Vulnerability Number

V-252925

Documentable

False

Rule Version

TOSS-04-010150

Severity Override Guidance

Verify the GnuTLS library is configured to only allow DOD-approved SSL/TLS Versions:

$ sudo grep -io +vers.* /etc/crypto-policies/back-ends/gnutls.config

+VERS-ALL:-VERS-DTLS0.9:-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1:-VERS-DTLS1.0:+COMP-NULL:%PROFILE_MEDIUM

If the "gnutls.config" does not list "-VERS-DTLS0.9:-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1:-VERS-DTLS1.0" to disable unapproved SSL/TLS versions, this is a finding.

Check Content Reference

M

Target Key

5469