| name | cis-azure-database-5.9 |
| description | Ensure server parameter 'tls_version' is set to 'TLSv1.2' (or higher) for MySQL flexible server |
| category | cis-azure-database |
| version | 2.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","mysql","database"] |
| cis_id | 5.9 |
| cis_benchmark | CIS Microsoft Azure Database Services Benchmark v2.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
5.9 Ensure server parameter 'tls_version' is set to 'TLSv1.2' (or higher) for MySQL flexible server (Automated)
Profile Applicability
Description
Ensure tls_version on MySQL flexible servers is set to use TLS version 1.2 or higher.
Rationale
The Secure Sockets Layer (SSL) protocol encrypts network traffic transiting between server and client.
Using only the most recent versions of SSL protocols (TLS version 1.2 and higher) eliminates susceptibility to known exploited vulnerabilities of outdated versions of TLS. If TLS 1.2 does not provide additional granular configuration options for supported cipher suites, there's a chance that default ciphers which employ Cipher Block Chaining (CBC) mode may be enabled which would introduce Padding Oracle types of vulnerabilities. TLS 1.3 does not support CBC mode ciphers by default and by default supports GCM ciphers which include an extra authentication step during the clear text to cipher text encryption process.
TLS version 1.3 is preferable where it is possible to implement.
Versions 1.0 and 1.1 of TLS are no longer considered secure. These versions should not be used or permitted where data integrity and confidentiality are required.
Impact
None specified.
Audit
Audit from Azure Portal
- Login to Azure Portal using https://portal.azure.com.
- Go to
Azure Database for MySQL flexible servers.
- For each database, under
Settings, click Server parameters.
- In the filter bar, type
tls_version.
- Ensure
tls_version is set to TLSv1.2 (or higher).
Audit from Azure CLI
Ensure the value of the below command contains TLSv1.2 or higher, and does not contain anything lower than TLSv1.2:
az mysql flexible-server parameter show --resource-group <resourceGroup> --server-name <serverName> --name tls_version
Example output:
{
"allowedValues": "TLSv1,TLSv1.1,TLSv1.2",
"dataType":
