Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-35064

OpenSSL Elliptic Curve Auto Negotiation Unsupported on RHEL 7 and Ubuntu 16.04

    XMLWordPrintable

Details

    • Bug
    • Status: Closed
    • Critical - P2
    • Resolution: Duplicate
    • 3.6.4, 3.7.9
    • None
    • Security
    • Linux

    Description

      Linux distros that have been GA for some time like RHEL 7 and Ubuntu 16.04 had to shoehorn TLS 1.2 support in later OS updates without breaking ABI compatibility. 

      See RHEL 7 for example.

      The way this was done does not allow binaries built against the older ABI to enable curve auto negotiation for ECDHE ciphers in our "forward compatible" binaries--e.g. one RHEL7 binary supports 7.0-7.4. We will need to try and address this by, e.g.

      • Hardcoding some things into MongoDB
      • Potentially upgrading our build machines and OS minima to RHEL 7.4

      Attachments

        Issue Links

          Activity

            People

              backlog-server-security Backlog - Security Team
              matt.lord Matt Lord (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              9 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: