Mitigation for TLS renegotiation Vulnerability

Community
1

CrateDB versions earlier than 5.7.2 are exposed to the client initiated renegotiation vulnerability.

We have released CrateDB 5.7.2 with TLS renegotiation disabled by default.

See Client initialized Session-Renegotiation DoS · Advisory · crate/crate · GitHub for details.

To mitigate this issue on earlier versions, please use flag rejectClientInitiatedRenegotiation.

  • If you use tarball distribution, use CRATE_JAVA_OPTS="-Djdk.tls.rejectClientInitiatedRenegotiation=true" ./bin/crate
  • If you run CrateDB on Docker, add --env CRATE_JAVA_OPTS="-Djdk.tls.rejectClientInitiatedRenegotiation=true" to your docker run command.
  • If you use package-based setup, add
    CRATE_JAVA_OPTS="-Djdk.tls.rejectClientInitiatedRenegotiation=true"
    to the /etc/default/crate file. See also Configuration Settings — CrateDB: Guide
2 Likes