Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-35064

OpenSSL Elliptic Curve Auto Negotiation Unsupported on RHEL 7 and Ubuntu 16.04

    XMLWordPrintableJSON

Details

    • Icon: Bug Bug
    • Resolution: Duplicate
    • Icon: Critical - P2 Critical - P2
    • None
    • 3.6.4, 3.7.9
    • Security
    • Server Security
    • Linux

    Description

      Linux distros that have been GA for some time like RHEL 7 and Ubuntu 16.04 had to shoehorn TLS 1.2 support in later OS updates without breaking ABI compatibility. 

      See RHEL 7 for example.

      The way this was done does not allow binaries built against the older ABI to enable curve auto negotiation for ECDHE ciphers in our "forward compatible" binaries--e.g. one RHEL7 binary supports 7.0-7.4. We will need to try and address this by, e.g.

      • Hardcoding some things into MongoDB
      • Potentially upgrading our build machines and OS minima to RHEL 7.4

      Attachments

        Activity

          People

            backlog-server-security Backlog - Security Team
            matt.lord Matt Lord (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            9 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: