Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-57630

Enable SSL_OP_NO_RENEGOTIATION on Ubuntu 18.04 when running against OpenSSL 1.1.1

    • Type: Icon: Bug Bug
    • Resolution: Fixed
    • Priority: Icon: Major - P3 Major - P3
    • 5.0.3, 4.4.9, 5.1.0-rc0
    • Affects Version/s: 4.4.6
    • Component/s: None
    • Labels:
    • Minor Change
    • ALL
    • v5.0, v4.4
    • Security 2021-07-12, Security 2021-07-26, Security 2021-08-09
    • 66

      The SSL_OP_NO_RENEGOTIATION was first added in the OpenSSL 1.1.1 release.


      It was backported to OpenSSL 1.1.0 and was shipped in 1.1.0h


      Ubuntu 18.04 comes with 1.1.0g (the version prior to SSL_OP_NO_RENEGOTIATION being added). As a result, MongoDB makes builds on Ubuntu 18.04 but uses compile-time detection to determine if SSL_OP_NO_RENEGOTIATION exists. Since it does not exist at compile time, MongoDB does not know about the flag and so we never try to disable it at runtime.

      MongoDB should instead on 1.1.0 OpenSSL platforms (Ubuntu 18.04, SLES 15, Debian 9) define SSL_OP_NO_RENEGOTIATION instead and perform a runtime check to see if it should be set based on the OpenSSL version.

            sara.golemon@mongodb.com Sara Golemon
            mark.benvenuto@mongodb.com Mark Benvenuto
            2 Vote for this issue
            8 Start watching this issue