CVE-2019-2982 - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported

CVE-2019-2982

Summary

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.17 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

References

Vulnerable Configurations

cpe:2.3:a:oracle:mysql:8.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:8.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:8.0.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:8.0.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:8.0.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:8.0.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:8.0.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:8.0.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:8.0.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:8.0.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:8.0.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:8.0.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:8.0.10:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:8.0.10:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:8.0.11:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:8.0.11:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:8.0.12:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:8.0.12:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:8.0.13:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:8.0.13:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:8.0.14:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:8.0.14:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:8.0.15:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:8.0.15:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:8.0.16:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:8.0.16:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:8.0.17:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:8.0.17:*:*:*:*:*:*:*

CVSS

Base:	4.0 (as of 11-11-2019 - 20:15)
Impact:
Exploitability:

CWE

NVD-CWE-noinfo

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	SINGLE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:S/C:N/I:N/A:P

redhat via4

rpms

rh-mysql80-mysql-0:8.0.21-1.el7
rh-mysql80-mysql-common-0:8.0.21-1.el7
rh-mysql80-mysql-config-0:8.0.21-1.el7
rh-mysql80-mysql-config-syspaths-0:8.0.21-1.el7
rh-mysql80-mysql-debuginfo-0:8.0.21-1.el7
rh-mysql80-mysql-devel-0:8.0.21-1.el7
rh-mysql80-mysql-errmsg-0:8.0.21-1.el7
rh-mysql80-mysql-server-0:8.0.21-1.el7
rh-mysql80-mysql-server-syspaths-0:8.0.21-1.el7
rh-mysql80-mysql-syspaths-0:8.0.21-1.el7
rh-mysql80-mysql-test-0:8.0.21-1.el7
mecab-0:0.996-1.module+el8.0.0+3898+e09bb8de.9
mecab-debuginfo-0:0.996-1.module+el8.0.0+3898+e09bb8de.9
mecab-debugsource-0:0.996-1.module+el8.0.0+3898+e09bb8de.9
mecab-ipadic-0:2.7.0.20070801-16.module+el8.0.0+3898+e09bb8de
mecab-ipadic-EUCJP-0:2.7.0.20070801-16.module+el8.0.0+3898+e09bb8de
mysql-0:8.0.21-1.module+el8.2.0+7855+47abd494
mysql-common-0:8.0.21-1.module+el8.2.0+7855+47abd494
mysql-debuginfo-0:8.0.21-1.module+el8.2.0+7855+47abd494
mysql-debugsource-0:8.0.21-1.module+el8.2.0+7855+47abd494
mysql-devel-0:8.0.21-1.module+el8.2.0+7855+47abd494
mysql-devel-debuginfo-0:8.0.21-1.module+el8.2.0+7855+47abd494
mysql-errmsg-0:8.0.21-1.module+el8.2.0+7855+47abd494
mysql-libs-0:8.0.21-1.module+el8.2.0+7855+47abd494
mysql-libs-debuginfo-0:8.0.21-1.module+el8.2.0+7855+47abd494
mysql-server-0:8.0.21-1.module+el8.2.0+7855+47abd494
mysql-server-debuginfo-0:8.0.21-1.module+el8.2.0+7855+47abd494
mysql-test-0:8.0.21-1.module+el8.2.0+7855+47abd494
mysql-test-debuginfo-0:8.0.21-1.module+el8.2.0+7855+47abd494
mecab-0:0.996-1.module+el8.0.0+3898+e09bb8de.9
mecab-debuginfo-0:0.996-1.module+el8.0.0+3898+e09bb8de.9
mecab-debugsource-0:0.996-1.module+el8.0.0+3898+e09bb8de.9
mecab-ipadic-0:2.7.0.20070801-16.module+el8.0.0+3898+e09bb8de
mecab-ipadic-EUCJP-0:2.7.0.20070801-16.module+el8.0.0+3898+e09bb8de
mysql-0:8.0.21-1.module+el8.0.0+7853+3a2b0b25
mysql-common-0:8.0.21-1.module+el8.0.0+7853+3a2b0b25
mysql-debuginfo-0:8.0.21-1.module+el8.0.0+7853+3a2b0b25
mysql-debugsource-0:8.0.21-1.module+el8.0.0+7853+3a2b0b25
mysql-devel-0:8.0.21-1.module+el8.0.0+7853+3a2b0b25
mysql-devel-debuginfo-0:8.0.21-1.module+el8.0.0+7853+3a2b0b25
mysql-errmsg-0:8.0.21-1.module+el8.0.0+7853+3a2b0b25
mysql-libs-0:8.0.21-1.module+el8.0.0+7853+3a2b0b25
mysql-libs-debuginfo-0:8.0.21-1.module+el8.0.0+7853+3a2b0b25
mysql-server-0:8.0.21-1.module+el8.0.0+7853+3a2b0b25
mysql-server-debuginfo-0:8.0.21-1.module+el8.0.0+7853+3a2b0b25
mysql-test-0:8.0.21-1.module+el8.0.0+7853+3a2b0b25
mysql-test-debuginfo-0:8.0.21-1.module+el8.0.0+7853+3a2b0b25
mecab-0:0.996-1.module+el8.0.0+3898+e09bb8de.9
mecab-debuginfo-0:0.996-1.module+el8.0.0+3898+e09bb8de.9
mecab-debugsource-0:0.996-1.module+el8.0.0+3898+e09bb8de.9
mecab-ipadic-0:2.7.0.20070801-16.module+el8.0.0+3898+e09bb8de
mecab-ipadic-EUCJP-0:2.7.0.20070801-16.module+el8.0.0+3898+e09bb8de
mysql-0:8.0.21-1.module+el8.1.0+7854+62e1520f
mysql-common-0:8.0.21-1.module+el8.1.0+7854+62e1520f
mysql-debuginfo-0:8.0.21-1.module+el8.1.0+7854+62e1520f
mysql-debugsource-0:8.0.21-1.module+el8.1.0+7854+62e1520f
mysql-devel-0:8.0.21-1.module+el8.1.0+7854+62e1520f
mysql-devel-debuginfo-0:8.0.21-1.module+el8.1.0+7854+62e1520f
mysql-errmsg-0:8.0.21-1.module+el8.1.0+7854+62e1520f
mysql-libs-0:8.0.21-1.module+el8.1.0+7854+62e1520f
mysql-libs-debuginfo-0:8.0.21-1.module+el8.1.0+7854+62e1520f
mysql-server-0:8.0.21-1.module+el8.1.0+7854+62e1520f
mysql-server-debuginfo-0:8.0.21-1.module+el8.1.0+7854+62e1520f
mysql-test-0:8.0.21-1.module+el8.1.0+7854+62e1520f
mysql-test-debuginfo-0:8.0.21-1.module+el8.1.0+7854+62e1520f

refmap via4

confirm	https://security.netapp.com/advisory/ntap-20191017-0002/
fedora	FEDORA-2019-48a0a07033 FEDORA-2019-c1fab3f139 FEDORA-2019-d40df38271
misc	http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
ubuntu	USN-4195-1

Last major update

11-11-2019 - 20:15

Published

16-10-2019 - 18:15

Last modified

11-11-2019 - 20:15