Search code examples
macosmongodbopensslmacports

mac ports openssl 1.0.2g disables SSLv2 which is required by mongodb

Updating openssl to 1.0.2g using mac ports disables the SSLv2 due to CVE-2016-0800

The problem is mongodb built using mac ports requires this SSLv2

dyld: Symbol not found: _SSLv2_client_method
  Referenced from: /opt/local/bin/mongod
  Expected in: /opt/local/lib/libssl.1.0.0.dylib
 in /opt/local/bin/mongod
Trace/BPT trap: 5

The solution according to CVE-2016-0800 is to define enable-ssl2 but even then they mention the following:

SSL_CTX_clear_options(ctx, SSL_OP_NO_SSLv2);

or

SSL_clear_options(ssl, SSL_OP_NO_SSLv2);

which I'm not sure if mongodb follows the directive.

  • Anyone has a reference for this on a mongodb issue?
  • Is there a simple fix on the mongodb code for this?
Solution

  • mongodb @3.2.3_1 solved the issue