Uploaded image for project: 'Percona Monitoring and Management'
  1. Percona Monitoring and Management
  2. PMM-8468

Forbid the use of outdated ciphers for HTTPS protocol on exporters

Details

    • 1
    • Yes
    • Yes
    • Yes
    • C/S Core

    Description

       Apparently the CBC cipher is considered vulnerable to LUCKY13 attack.

      PMM is 2.15.1, deployed on Docker.

       

      Suggested implementation:

       

      Remove CBC ciphers from https://github.com/percona/exporter_shared/blob/master/server.go#L107

      Update and then release all exporters which uses exporter_shared library.

       

      }}{{CipherSuites: []uint16{
                  tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
                  tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
                  tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
                  tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
                  tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
                  tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
              },

       

      Attachments

        Activity

          People

            Unassigned Unassigned
            corrado.pandiani Corrado Pandiani
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Smart Checklist