UCF STIG Viewer Logo

MariaDB must implement NIST FIPS 140-2 validated cryptographic modules to generate and validate cryptographic hashes.


Overview

Finding ID Version Rule ID IA Controls Severity
V-253774 MADB-10-012200 SV-253774r841847_rule Medium
Description
Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The application must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated. For detailed information, refer to NIST FIPS Publication 140-2, Security Requirements For Cryptographic Modules. Note that the product's cryptographic modules must be validated and certified by NIST as FIPS-compliant.
STIG Date
MariaDB Enterprise 10.x Security Technical Implementation Guide 2022-08-24

Details

Check Text ( C-57226r841845_chk )
As the system administrator, run the following at the Linux commands:

# openssl version
OpenSSL 1.0.2k-fips 26 Jan 2017

If fips is not included in the openssl version, this is a finding.

# sysctl crypto.fips_enabled
crypto.fips_enabled = 1

If crypto.fips_enabled = 0, this is a finding.

MariaDB> SHOW GLOBAL VARIABLES LIKE ‘%have_openssl%';

If the value of have_openssl is not YES, this is a finding.

MariaDB> SHOW GLOBAL VARIABLES LIKE ‘%version_ssl_library%';

If the value of version_ssl_library does not contain fips this is a finding.

Examine the application's code to ensure is does not make calls using libmysqlclient.

If code uses libmysqlclient, this is a finding.
Fix Text (F-57177r841846_fix)
If crypto.fips_enabled = 0, configure operating system per operating system documentation:
RedHat: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/chap-federal_standards_and_regulations
Ubuntu: https://security-certs.docs.ubuntu.com/en/fips