DBD::mysql and SSL/TLS

[Daniël van Eeden <daniel.vaneeden () booking com>]

Hi,

I have some serious concerns about the state of SSL/TLS in DBD::mysql.

Issue 1: CVE-2017-10789 isn't fixed
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10789

Issue 2: Using DBD::mysql with MariaDB 10.0 or higher or MySQL 8.0 or
higher provides a false sense of security

SSL_LAST_VERIFY_VERSION is set to 50799.
Any version higher than that silently ignores mysql_ssl_verify_server_cert

This can lead to unencrypted connections even with strict SSL settings.

Issue 3: If SSL support is unavailable but ssl options are set then these
options are silently ignored.

issue 4: If compiled against MySQL 5.7 then SSL/TLS is used when available,
but can't be disabled. (mysql_ssl=0 is ignored).

This makes upgrading to 5.7 more difficult. And 5.7 is needed to get
support for TLSv1.1 and TLSv1.2.

There is a patch available for this:
https://github.com/perl5-dbi/DBD-mysql/pull/114


-- 
Daniël van Eeden
Database Administrator

Booking.com B.V.
Vijzelstraat 66-80 Amsterdam 1017HL Netherlands
Direct +31207033812
[image: Booking.com] <http://www.booking.com/>
The world's #1 accommodation site
43 languages, 187+ offices worldwide, 96,000+ global destinations,
1,200,000+ room nights booked every day
No booking fees, best price always guaranteed
Subsidiary of the Priceline Group (NASDAQ: PCLN)