vulnerability CVE-2004-2761 on SQL server.

Question

Post reply

vulnerability CVE-2004-2761 on SQL server.

prsnn_shetty

Right there with Babe

Points: 750
More actions
February 1, 2022 at 4:17 am

#3979423

Hi
We have got few point of action for vulnerability CVE-2004-2761(SSL Certificate Signed Using Weak Hashing Algorithm)on our SQL servers.
, OS Windows Server 2016 Standard. Please let us know how can we close this.
Regards
Prasanna Shetty

Viewing 7 posts - 1 through 6 (of 6 total)

You must be logged in to reply to this topic. Login to reply

Ant-Green SSC Guru Points: 113507 More actions · Answer 1

Two options.

Upgrade to SQL2017 or SQL2019

Create your own SSL certificate trusted by a CA and put that in place instead.

https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/enable-encrypted-connections-to-the-database-engine?view=sql-server-ver15

You don’t need to enforce encrypted connections but you need to have the certificate thumbprint in the configuration to use your cert and not the fallback cert.

prsnn_shetty Right there with Babe Points: 750 More actions · Answer 2

prsnn_shetty

Right there with Babe

Points: 750

February 1, 2022 at 7:22 am

#3979451

Thanks Ant-Green

osca1069 Newbie Points: 2 More actions · Answer 3

Hi sir, the problem is that as a practice we have be never used SSL certificate trusted by a CA in our SQL instances, what should we do in this specific case to solve the vulnerability?

Thanks

Ant-Green SSC Guru Points: 113507 More actions · Answer 4

osca1069 wrote:

Hi sir, the problem is that as a practice we have be never used SSL certificate trusted by a CA in our SQL instances, what should we do in this specific case to solve the vulnerability?
Thanks

Upgrade to SQL 2019/SQL 2022.

osca1069 Newbie Points: 2 More actions · Answer 5

Hi sir, we have other SQL Server 2016 instances, why doesn't the vulnerability appear in them as well?

Ant-Green SSC Guru Points: 113507 More actions · Answer 6

Probably not using the default fallback cert.

But still you should be upgrading. 2016 is a dead product now in terms of MSFT.