STIGQter: STIG Summary: MariaDB Enterprise 10.x Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Apr 2026:

MariaDB must prohibit the use of cached authenticators after an organization-defined time period.

DISA Rule

SV-253736r961521_rule

Vulnerability Number

V-253736

Group Title

SRG-APP-000400-DB-000367

Rule Version

MADB-10-008300

Severity

CAT II

CCI(s)

• CCI-002007 - Prohibit the use of cached authenticators after an organization-defined time period.

Weight

10

Fix Recommendation

Verify that the idle_transaction_wait is set to a value greater than 0 or is set to the value needed by the administrator. The value of idle_transaction_wait can be validated by issuing SHOW VARIABLES. Example:

Locate the MariaDB Enterprise Server configuration files in /etc/my.cnf.d/. Add the following:

Under the [mariadb] section:

idle_transaction_timeout = 60

After making changes to the .cnf file, stop and restart the database service.

Check Contents

The system parameter idle_transaction_timeout specifies in seconds when a connection will be terminated due to inactivity. After a connection is terminated, a new request to the database must be preceded by an authentication, which is not cached within the database.

Run the following SQL:
MariaDB> SHOW GLOBAL VARIABLES LIKE 'idle_transaction_timeout';

If the value is 0, this is a finding.

Vulnerability Number

V-253736

Documentable

False

Rule Version

MADB-10-008300

Severity Override Guidance

The system parameter idle_transaction_timeout specifies in seconds when a connection will be terminated due to inactivity. After a connection is terminated, a new request to the database must be preceded by an authentication, which is not cached within the database.

Run the following SQL:
MariaDB> SHOW GLOBAL VARIABLES LIKE 'idle_transaction_timeout';

If the value is 0, this is a finding.

Check Content Reference

M

Target Key

5475