STIGQter: STIG Summary: MariaDB Enterprise 10.x Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Apr 2026:

MariaDB must map PKI ID to an associated user account.

DISA Rule

SV-253701r961044_rule

Vulnerability Number

V-253701

Group Title

SRG-APP-000177-DB-000069

Rule Version

MADB-10-004200

Severity

CAT II

CCI(s)

• CCI-000187 - For public key-based authentication, map the authenticated identity to the account of the individual or group.

Weight

10

Fix Recommendation

Example command to create users with proper X509 certificate subject and issuer:

MariaDB>CREATE USER 'janedoe'@'%' IDENTIFIED BY 'Some_Password_Here_$9'
REQUIRE SUBJECT '/C=US/ST=Ohio/L=Columbus/O=MariaDB Corporation/CN=Jane Doe'
AND ISSUER '/C=US/ST=Ohio/L=Columbus/O=MariaDB Corporation/CN=MariaDB CA';

Check Contents

Query all users to confirm issuer and subject are configured correctly:

MariaDB>SELECT user, host, ssl_type, CAST(x509_issuer AS CHAR) AS issuer, CAST(x509_subject AS CHAR) AS subject FROM mysql.user;

If users are not mapped correctly, this is a finding.

Vulnerability Number

V-253701

Documentable

False

Rule Version

MADB-10-004200

Severity Override Guidance

Query all users to confirm issuer and subject are configured correctly:

MariaDB>SELECT user, host, ssl_type, CAST(x509_issuer AS CHAR) AS issuer, CAST(x509_subject AS CHAR) AS subject FROM mysql.user;

If users are not mapped correctly, this is a finding.

Check Content Reference

M

Target Key

5475