Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-35064

OpenSSL Elliptic Curve Auto Negotiation Unsupported on RHEL 7 and Ubuntu 16.04

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Critical - P2
    • Resolution: Duplicate
    • Affects Version/s: 3.6.4, 3.7.9
    • Fix Version/s: None
    • Component/s: Security
    • Labels:
    • Operating System:
      Linux

      Description

      Linux distros that have been GA for some time like RHEL 7 and Ubuntu 16.04 had to shoehorn TLS 1.2 support in later OS updates without breaking ABI compatibility. 

      See RHEL 7 for example.

      The way this was done does not allow binaries built against the older ABI to enable curve auto negotiation for ECDHE ciphers in our "forward compatible" binaries--e.g. one RHEL7 binary supports 7.0-7.4. We will need to try and address this by, e.g.

      • Hardcoding some things into MongoDB
      • Potentially upgrading our build machines and OS minima to RHEL 7.4

        Attachments

          Issue Links

          has to be done before

          Task - A task that needs to be done. SERVER-34911 Restrict TLS ciphers supported by servers and clients

          • Major - P3 - Major loss of function.
          • Closed
          is duplicated by

          Task - A task that needs to be done. SERVER-36616 Enable ECDHE support if platform supports it

          • Major - P3 - Major loss of function.
          • Closed

            Activity

              People

              Assignee:
              backlog-server-security Backlog - Security Team
              Reporter:
              matt.lord Matt Lord (Inactive)
              Participants:
              Votes:
              0 Vote for this issue
              Watchers:
              9 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved: