Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-35064

OpenSSL Elliptic Curve Auto Negotiation Unsupported on RHEL 7 and Ubuntu 16.04

    • Type: Icon: Bug Bug
    • Resolution: Duplicate
    • Priority: Icon: Critical - P2 Critical - P2
    • None
    • Affects Version/s: 3.6.4, 3.7.9
    • Component/s: Security
    • Server Security
    • Linux

      Linux distros that have been GA for some time like RHEL 7 and Ubuntu 16.04 had to shoehorn TLS 1.2 support in later OS updates without breaking ABI compatibility. 

      See RHEL 7 for example.

      The way this was done does not allow binaries built against the older ABI to enable curve auto negotiation for ECDHE ciphers in our "forward compatible" binaries--e.g. one RHEL7 binary supports 7.0-7.4. We will need to try and address this by, e.g.

      • Hardcoding some things into MongoDB
      • Potentially upgrading our build machines and OS minima to RHEL 7.4

            Assignee:
            backlog-server-security [DO NOT USE] Backlog - Security Team
            Reporter:
            matt.lord Matt Lord (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            9 Start watching this issue

              Created:
              Updated:
              Resolved: