1

Azure advisor has recommended: Your Azure Database for MySQL - Flexible Server is vulnerable using weak, deprecated TLSv1 or TLSv1.1 protocols

I have checked my tls_version on my MySql server and returned TLSv1.2.

Unsure why Azure thinks I am running a deprecated TLS version when the only version listed is TLSv1.2.. Help would be appreciated. Thanks.

henry434
  • 97
  • 1
  • 9

1 Answers1

0

It's not that you actually use the obsolete old versions of TLS, it's that your MySql server can use them. That's a vulnerability because cybercreeps can try to connect to your server with them and then exploit their weaknesses.

Writeup here.

Say this to MySql: SHOW GLOBAL VARIABLES LIKE 'tls_version'. You'll probably see something like TLSv1,TLSv1.1,TLSv1.2.

You can change this system variable to say just TLSv1.2 at MySql server startup time. Doing so will remove the vulnerability. (Changing the startup configuration is described in the linked article, and it's tricky enough that you should read the article; I don't want to try to give you a short version here, because the exact configurations can be OS and MySql version dependent.)

Or the security advisor program you use has it wrong. That is possible.

O. Jones
  • 103,626
  • 17
  • 118
  • 172
  • `SHOW GLOBAL VARIABLES LIKE 'tls_version'` returns just: `TLSv1.2`. I'm thinking it could be to do with the list of allowed ciphers under `SHOW GLOBAL VARIABLES LIKE 'ssl_cipher'`. I'm thinking perhaps there are `v1.0, v1.1` ciphers allowed. Although wouldnt the `tls_version` variable stop them from being used? – henry434 Apr 07 '22 at 12:01
  • Yes, the vulnerability is in the tls version. Plus, on the "Flexible Server" offering you can't change the ciphers. [This](https://learn.microsoft.com/en-us/azure/mysql/flexible-server/how-to-connect-tls-ssl) claims V1.2 is the default, and that's confirmed by SHOW GLOBAL VARIABLES. You might ask azure support about this. (Is it possible you have some other database instance someplace that's actually the subject of this report?) – O. Jones Apr 07 '22 at 12:29