DBD::mysql and SSL/TLS

--94eb2c1c0a4a5f1f4d056294d321
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi,

I have some serious concerns about the state of SSL/TLS in DBD::mysql.

Issue 1: CVE-2017-10789 isn't fixed
https://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2017-10789

Issue 2: Using DBD::mysql with MariaDB 10.0 or higher or MySQL 8.0 or
higher provides a false sense of security

SSL_LAST_VERIFY_VERSION is set to 50799.
Any version higher than that silently ignores mysql_ssl_verify_server_cert

This can lead to unencrypted connections even with strict SSL settings.

Issue 3: If SSL support is unavailable but ssl options are set then these
options are silently ignored.

issue 4: If compiled against MySQL 5.7 then SSL/TLS is used when available,
but can't be disabled. (mysql_ssl=3D0 is ignored).

This makes upgrading to 5.7 more difficult. And 5.7 is needed to get
support for TLSv1.1 and TLSv1.2.

There is a patch available for this:
https://github.com/perl5-dbi/DBD-mysql/pull/114


--=20
Dani=C3=ABl van Eeden
Database Administrator

Booking.com B.V.
Vijzelstraat 66-80 Amsterdam 1017HL Netherlands
Direct +31207033812
[image: Booking.com] <http://www.booking.com/>
The world's #1 accommodation site
43 languages, 187+ offices worldwide, 96,000+ global destinations,
1,200,000+ room nights booked every day
No booking fees, best price always guaranteed
Subsidiary of the Priceline Group (NASDAQ: PCLN)

--94eb2c1c0a4a5f1f4d056294d321
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div><div><div><div><div>Hi,<br><br></div>I have some seri=
ous concerns about the state of SSL/TLS in DBD::mysql.<br><br></div>Issue 1=
: CVE-2017-10789 isn&#39;t fixed<br><a href=3D"https://cve.mitre.org/cgi-bi=
n/cvename.cgi?name=3DCVE-2017-10789">https://cve.mitre.org/cgi-bin/cvename.=
cgi?name=3DCVE-2017-10789</a><br><br></div>Issue 2: Using DBD::mysql with M=
ariaDB 10.0 or higher or MySQL 8.0 or higher provides a false sense of secu=
rity<br><br>SSL_LAST_VERIFY_VERSION is set to 50799.<br></div>Any version h=
igher than that silently ignores mysql_ssl_verify_server_cert<br><br></div>=
This can lead to unencrypted connections even with strict SSL settings. <br=
><div><div><div><div><div><br></div><div>Issue 3: If SSL support is unavail=
able but ssl options are set then these options are silently ignored.</div>=
<div><br></div><div>issue 4: If compiled against MySQL 5.7 then SSL/TLS is =
used when available, but can&#39;t be disabled. (mysql_ssl=3D0 is ignored).=
</div><div><br></div><div>This makes upgrading to 5.7 more difficult. And 5=
..7 is needed to get support for TLSv1.1 and TLSv1.2.</div><div><br></div><d=
iv>There is a patch available for this:<br></div><div><a href=3D"https://gi=
thub.com/perl5-dbi/DBD-mysql/pull/114">https://github.com/perl5-dbi/DBD-mys=
ql/pull/114</a></div><div><br></div><div><div><br>-- <br><div class=3D"gmai=
l_signature"><span style=3D"display:block;font-size:11pt;font-family:Centur=
y Gothic;color:rgb(0,53,128)"><div style=3D"color:rgb(0,53,128);font-family=
:Arial,Helvetica,sans-serif;font-weight:bold;font-size:15px"><div>Dani=C3=
=ABl van Eeden</div><div style=3D"font-weight:normal;font-size:13px;color:r=
gb(0,174,239)">Database Administrator<br><br></div><div style=3D"font-weigh=
t:normal;font-size:13px;color:rgb(102,102,102)">Booking.com B.V.<br>Vijzels=
traat 66-80  Amsterdam  1017HL Netherlands</div><div style=3D"font-weight:n=
ormal;font-size:13px;color:rgb(102,102,102)"><span style=3D"color:rgb(0,174=
,239)">Direct=C2=A0</span>+31207033812</div><div style=3D"font-weight:norma=
l;font-size:13px;color:rgb(102,102,102)"><div style=3D"font-weight:bold;fon=
t-size:16px;color:rgb(0,53,128)"><a href=3D"http://www.booking.com/" style=
=3D"color:rgb(0,127,255);background-image:initial;background-position:initi=
al;background-repeat:initial" target=3D"_blank"><img src=3D"http://bstatic.=
com/static/img/siglogo.jpg" alt=3D"Booking.com" title=3D"Booking.com"></a><=
/div><span style=3D"font-size:11px">The world&#39;s #1 accommodation site=
=C2=A0<br>43 languages, 187+ offices worldwide, 96,000+ global destinations=
, 1,200,000+ room nights booked every day=C2=A0<br>No booking fees, best pr=
ice always guaranteed=C2=A0<br>Subsidiary of the Priceline Group (NASDAQ: P=
CLN)=C2=A0</span></div></div></span></div>
</div></div></div></div></div></div></div>

--94eb2c1c0a4a5f1f4d056294d321--
0
dbi
1/12/2018 2:10:23 PM
perl.dbi.dev 1919 articles. 0 followers. Follow

1 Replies
109 Views

Similar Articles

[PageSpeed] 6

--001a1144a2b6e728760562b79581
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Thanks for pointing this out. We had applied these patches before but had
to revert because of breakage created by other changes in the code.

The difficulty is also that mariadb and MySQL use a different approach to
handling TLS in the client libs.

I'll make sure we'll apply this PR again and create a release ASAP.

--
Michiel

Op 14 jan. 2018 06:49 schreef "Dani=C3=ABl van Eeden via dbi-dev" <
dbi-dev@perl.org>:

> Hi,
>
> I have some serious concerns about the state of SSL/TLS in DBD::mysql.
>
> Issue 1: CVE-2017-10789 isn't fixed
> https://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2017-10789
>
> Issue 2: Using DBD::mysql with MariaDB 10.0 or higher or MySQL 8.0 or
> higher provides a false sense of security
>
> SSL_LAST_VERIFY_VERSION is set to 50799.
> Any version higher than that silently ignores mysql_ssl_verify_server_cer=
t
>
> This can lead to unencrypted connections even with strict SSL settings.
>
> Issue 3: If SSL support is unavailable but ssl options are set then these
> options are silently ignored.
>
> issue 4: If compiled against MySQL 5.7 then SSL/TLS is used when
> available, but can't be disabled. (mysql_ssl=3D0 is ignored).
>
> This makes upgrading to 5.7 more difficult. And 5.7 is needed to get
> support for TLSv1.1 and TLSv1.2.
>
> There is a patch available for this:
> https://github.com/perl5-dbi/DBD-mysql/pull/114
>
>
> --
> Dani=C3=ABl van Eeden
> Database Administrator
>
> Booking.com B.V.
> Vijzelstraat 66
> <https://maps.google.com/?q=3DVijzelstraat+66&entry=3Dgmail&source=3Dg>-8=
0
> Amsterdam 1017HL Netherlands
> Direct +31207033812 <020%20703%203812>
> [image: Booking.com] <http://www.booking.com/>
> The world's #1 accommodation site
> 43 languages, 187+ offices worldwide, 96,000+ global destinations,
> 1,200,000+ room nights booked every day
> No booking fees, best price always guaranteed
> Subsidiary of the Priceline Group (NASDAQ: PCLN)
>

--001a1144a2b6e728760562b79581
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"auto">Thanks for pointing this out. We had applied these patche=
s before but had to revert because of breakage created by other changes in =
the code.=C2=A0<div dir=3D"auto"><br></div><div dir=3D"auto">The difficulty=
 is also that mariadb and MySQL use a different approach to handling TLS in=
 the client libs.=C2=A0</div><div dir=3D"auto"><br></div><div dir=3D"auto">=
I&#39;ll make sure we&#39;ll apply this PR again and create a release ASAP.=
</div><div dir=3D"auto"><br></div><div dir=3D"auto">--</div><div dir=3D"aut=
o">Michiel</div></div><div class=3D"gmail_extra"><br><div class=3D"gmail_qu=
ote">Op 14 jan. 2018 06:49 schreef &quot;Dani=C3=ABl van Eeden via dbi-dev&=
quot; &lt;<a href=3D"mailto:dbi-dev@perl.org" target=3D"_blank">dbi-dev@per=
l.org</a>&gt;:<br type=3D"attribution"><blockquote class=3D"gmail_quote" st=
yle=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div =
dir=3D"ltr"><div><div><div><div><div>Hi,<br><br></div>I have some serious c=
oncerns about the state of SSL/TLS in DBD::mysql.<br><br></div>Issue 1: CVE=
-2017-10789 isn&#39;t fixed<br><a href=3D"https://cve.mitre.org/cgi-bin/cve=
name.cgi?name=3DCVE-2017-10789" target=3D"_blank">https://cve.mitre.org/cgi=
-bin/<wbr>cvename.cgi?name=3DCVE-2017-<wbr>10789</a><br><br></div>Issue 2: =
Using DBD::mysql with MariaDB 10.0 or higher or MySQL 8.0 or higher provide=
s a false sense of security<br><br>SSL_LAST_VERIFY_VERSION is set to 50799.=
<br></div>Any version higher than that silently ignores mysql_ssl_verify_se=
rver_cert<br><br></div>This can lead to unencrypted connections even with s=
trict SSL settings. <br><div><div><div><div><div><br></div><div>Issue 3: If=
 SSL support is unavailable but ssl options are set then these options are =
silently ignored.</div><div><br></div><div>issue 4: If compiled against MyS=
QL 5.7 then SSL/TLS is used when available, but can&#39;t be disabled. (mys=
ql_ssl=3D0 is ignored).</div><div><br></div><div>This makes upgrading to 5.=
7 more difficult. And 5.7 is needed to get support for TLSv1.1 and TLSv1.2.=
</div><div><br></div><div>There is a patch available for this:<br></div><di=
v><a href=3D"https://github.com/perl5-dbi/DBD-mysql/pull/114" target=3D"_bl=
ank">https://github.com/perl5-dbi/<wbr>DBD-mysql/pull/114</a></div><div><br=
></div><div><div><br>-- <br><div class=3D"m_4837833305603391353gmail_signat=
ure"><span style=3D"display:block;font-size:11pt;font-family:Century Gothic=
;color:rgb(0,53,128)"><div style=3D"color:rgb(0,53,128);font-family:Arial,H=
elvetica,sans-serif;font-weight:bold;font-size:15px"><div>Dani=C3=ABl van E=
eden</div><div style=3D"font-weight:normal;font-size:13px;color:rgb(0,174,2=
39)">Database Administrator<br><br></div><div style=3D"font-weight:normal;f=
ont-size:13px;color:rgb(102,102,102)">Booking.com B.V.<br><a href=3D"https:=
//maps.google.com/?q=3DVijzelstraat+66&amp;entry=3Dgmail&amp;source=3Dg">Vi=
jzelstraat 66</a>-80  Amsterdam  1017HL Netherlands</div><div style=3D"font=
-weight:normal;font-size:13px;color:rgb(102,102,102)"><span style=3D"color:=
rgb(0,174,239)">Direct=C2=A0</span><a href=3D"tel:020%20703%203812" value=
=3D"+31207033812" target=3D"_blank">+31207033812</a></div><div style=3D"fon=
t-weight:normal;font-size:13px;color:rgb(102,102,102)"><div style=3D"font-w=
eight:bold;font-size:16px;color:rgb(0,53,128)"><a href=3D"http://www.bookin=
g.com/" style=3D"color:rgb(0,127,255);background-image:initial;background-p=
osition:initial;background-repeat:initial" target=3D"_blank"><img src=3D"ht=
tp://bstatic.com/static/img/siglogo.jpg" alt=3D"Booking.com" title=3D"Booki=
ng.com"></a></div><span style=3D"font-size:11px">The world&#39;s #1 accommo=
dation site=C2=A0<br>43 languages, 187+ offices worldwide, 96,000+ global d=
estinations, 1,200,000+ room nights booked every day=C2=A0<br>No booking fe=
es, best price always guaranteed=C2=A0<br>Subsidiary of the Priceline Group=
 (NASDAQ: PCLN)=C2=A0</span></div></div></span></div>
</div></div></div></div></div></div></div>
</blockquote></div></div>

--001a1144a2b6e728760562b79581--
0
michiel
1/14/2018 7:38:35 AM
Reply: