What changed in VMware vSphere 7.0 vCenter Appliance PostgreSQL STIG V1R3V1R3 changes

VMware vSphere 7.0 vCenter Appliance PostgreSQL STIG V1R3 (2026-09-30) replaced V1R2 (2023-07-26): 3 checks updated. It has 20 checks, against 20 in V1R2.

V1R3 checklistV1R2 checklist Compare V1R2 and V1R3 in STIG Compare

  • 0 added
  • 0 removed
  • 3 updated

Updated fields: Discussion 3

Updated in V1R3 (3)

V-256600CAT IIThe vPostgres database must use "md5" for authentication.Discussion

Discussion

The DODDoW standard for authentication is DODDoW-approved public key infrastructure (PKI) certificates. Authentication based on user ID and password may be used only when it is not possible to employ a PKI certificate, and requires authorizing official approval. In such cases, database passwords stored in clear text, using reversible encryption or unsalted hashes, would be vulnerable to unauthorized disclosure. Database passwords must always be in the form of one-way, salted hashes when stored internally or externally to the database management system (DBMS).

V-256600 in V1R3

V-256601CAT IVMware Postgres must be configured to use Transport Layer Security (TLS).Discussion

Discussion

The DODDoW standard for authentication is DODDoW-approved public key infrastructure (PKI) certificates. Authentication based on user ID and password may be used only when it is not possible to employ a PKI certificate. In such cases, passwords, must be protected at all times, and encryption is the standard method for protecting passwords during transmission. VMware Postgres is configured out of the box to require TLS connections with remote clients. As an embedded database and available only on "localhost" for standalone vCenter Server Appliances (VCSAs), TLS connections are used only in high-availability deployments for connections between a primary and a standby. This configuration must be verified and maintained. Satisfies: SRG-APP-000172-DB-000075, SRG-APP-000442-DB-000379

V-256601 in V1R3

V-256602CAT IVMware Postgres must enforce authorized access to all public key infrastructure (PKI) private keys.Discussion

Discussion

The DODDoW standard for authentication is DODDoW-approved PKI certificates. PKI certificate-based authentication is performed by requiring the certificate holder to cryptographically prove possession of the corresponding private key. If a private key is stolen, an attacker can use it to impersonate the certificate holder. In cases where the database management system (DBMS)-stored private keys are used to authenticate the DBMS to the system's clients, loss of the corresponding private keys would allow an attacker to successfully perform undetected man-in-the-middle attacks against the DBMS system and its clients. All access to the private key(s) of the DBMS must be restricted to authorized and authenticated users.

V-256602 in V1R3

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V1R3 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.