# Mitigation for TLS renegotiation Vulnerability

**URL:** <https://community.cratedb.com/t/mitigation-for-tls-renegotiation-vulnerability/1791>\
**Category:** Community\
**Created:** [June 24, 2024, 12:55pm UTC](https://community.cratedb.com/t/mitigation-for-tls-renegotiation-vulnerability/1791 "2024-06-24T12:55:59Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Baur](https://sea2.discourse-cdn.com/flex020/user_avatar/community.cratedb.com/baur/32/284_2.png) [@Baur](https://community.cratedb.com/u/Baur)\
**Post date:** [June 24, 2024, 12:55pm UTC](https://community.cratedb.com/t/mitigation-for-tls-renegotiation-vulnerability/1791/1 "2024-06-24T12:55:59Z")

</div>

CrateDB versions earlier than 5.7.2 are exposed to the client initiated renegotiation vulnerability.

We have released CrateDB 5.7.2 with TLS renegotiation disabled by default.

See [Client initialized Session-Renegotiation DoS · Advisory · crate/crate · GitHub](https://github.com/crate/crate/security/advisories/GHSA-x268-qpg6-w9g2) for details.

To mitigate this issue on earlier versions, please use flag `rejectClientInitiatedRenegotiation`.

- If you use tarball distribution, use `CRATE_JAVA_OPTS="-Djdk.tls.rejectClientInitiatedRenegotiation=true" ./bin/crate`
- If you run CrateDB on Docker, add `--env CRATE_JAVA_OPTS="-Djdk.tls.rejectClientInitiatedRenegotiation=true"` to your `docker run` command.
- If you use package-based setup, add  
`CRATE_JAVA_OPTS="-Djdk.tls.rejectClientInitiatedRenegotiation=true"`  
to the `/etc/default/crate` file. See also [Configuration Settings — CrateDB: Guide](https://cratedb.com/docs/guide/install/configure.html#environment-variables)