Automated engine patching may be disabled, or maintenance windows may be deferred indefinitely, so the database engine continues to run a version with published vulnerabilities. Those vulnerabilities can be exploited by any client able to reach the engine, compromising the confidentiality, integrity, and availability of the database.
Database Engine Runs with Known Vulnerabilities
CCC.RDMS.TH06
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.RDMS.CP18 | Automated Engine Patching | The service may be configured to apply database engine security patches and minor version upgrades during a maintenance window, to limit exposure to known engine vulnerabilities; on some providers this is always on. |
| CCC.RDMS.CP02 | DB Engine Option - MySQL | The service can provision a managed relational database running the MySQL engine. |
| CCC.RDMS.CP03 | DB Engine Option - PostgreSQL | The service can provision a managed relational database running the PostgreSQL engine. |
| CCC.RDMS.CP05 | DB Engine Option - SQL Server | The service can provision a managed relational database running the Microsoft SQL Server engine. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.RDMS.CN06 | Apply Database Engine Security Patches | Ensure that the database engine runs a supported version and receives security patches automatically, so that published engine vulnerabilities cannot be exploited against the instance. |