Vulnerability-Lookup

RHSA-2020_5654

Vulnerability from csaf_redhat - Published: 2020-12-22 10:50 - Updated: 2024-11-15 11:45

Summary

Red Hat Security Advisory: mariadb:10.3 security, bug fix, and enhancement update

Severity

Important

Notes

Topic: An update for the mariadb:10.3 module is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a later upstream version: mariadb (10.3.27), galera (25.3.31). (BZ#1899083, BZ#1899087) Security Fix(es): * mariadb: Insufficient SST method name check leading to code injection in mysql-wsrep (CVE-2020-15180) * mysql: InnoDB unspecified vulnerability (CPU Oct 2019) (CVE-2019-2938) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2019) (CVE-2019-2974) * mysql: C API unspecified vulnerability (CPU Apr 2020) (CVE-2020-2752) * mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2760) * mysql: Server: DML unspecified vulnerability (CPU Apr 2020) (CVE-2020-2780) * mysql: Server: Stored Procedure unspecified vulnerability (CPU Apr 2020) (CVE-2020-2812) * mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2814) * mariadb-connector-c: Improper validation of content in a OK packet received from server (CVE-2020-13249) * mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14765) * mysql: InnoDB unspecified vulnerability (CPU Oct 2020) (CVE-2020-14776) * mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14789) * mysql: Server: Locking unspecified vulnerability (CPU Oct 2020) (CVE-2020-14812) * mysql: C API unspecified vulnerability (CPU Jan 2020) (CVE-2020-2574) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * FTBFS: -D_GLIBCXX_ASSERTIONS (BZ#1899010) * Queries with entity_id IN ('1', '2', …, '70000') run much slower in MariaDB 10.3 than on MariaDB 10.1 (BZ#1899018) * Cleanup race with wsrep_rsync_sst_tunnel may prevent full galera cluster bootstrap (BZ#1899022) * There are undeclared file conflicts in several mariadb and mysql packages (BZ#1899078)

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2019-2938

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

4.4 (Medium)


                
                  CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 116 products

Product	Version	Remediation
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:Judy-0:1.0.5-18.module+el8+2765+cfa4f87b.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:Judy-0:1.0.5-18.module+el8+2765+cfa4f87b.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:Judy-0:1.0.5-18.module+el8+2765+cfa4f87b.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:Judy-0:1.0.5-18.module+el8+2765+cfa4f87b.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:Judy-0:1.0.5-18.module+el8+2765+cfa4f87b.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:Judy-debuginfo-0:1.0.5-18.module+el8+2765+cfa4f87b.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:Judy-debuginfo-0:1.0.5-18.module+el8+2765+cfa4f87b.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:Judy-debuginfo-0:1.0.5-18.module+el8+2765+cfa4f87b.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:Judy-debuginfo-0:1.0.5-18.module+el8+2765+cfa4f87b.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:Judy-debugsource-0:1.0.5-18.module+el8+2765+cfa4f87b.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:Judy-debugsource-0:1.0.5-18.module+el8+2765+cfa4f87b.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:Judy-debugsource-0:1.0.5-18.module+el8+2765+cfa4f87b.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:Judy-debugsource-0:1.0.5-18.module+el8+2765+cfa4f87b.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:galera-0:25.3.31-1.module+el8.2.0+8857+d5b3039b.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:galera-0:25.3.31-1.module+el8.2.0+8857+d5b3039b.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:galera-0:25.3.31-1.module+el8.2.0+8857+d5b3039b.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:galera-0:25.3.31-1.module+el8.2.0+8857+d5b3039b.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:galera-0:25.3.31-1.module+el8.2.0+8857+d5b3039b.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:galera-debuginfo-0:25.3.31-1.module+el8.2.0+8857+d5b3039b.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:galera-debuginfo-0:25.3.31-1.module+el8.2.0+8857+d5b3039b.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:galera-debuginfo-0:25.3.31-1.module+el8.2.0+8857+d5b3039b.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:galera-debuginfo-0:25.3.31-1.module+el8.2.0+8857+d5b3039b.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:galera-debugsource-0:25.3.31-1.module+el8.2.0+8857+d5b3039b.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:galera-debugsource-0:25.3.31-1.module+el8.2.0+8857+d5b3039b.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:galera-debugsource-0:25.3.31-1.module+el8.2.0+8857+d5b3039b.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:galera-debugsource-0:25.3.31-1.module+el8.2.0+8857+d5b3039b.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-backup-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-backup-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-backup-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-backup-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-backup-debuginfo-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-backup-debuginfo-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-backup-debuginfo-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-backup-debuginfo-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-common-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-common-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-common-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-common-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-debuginfo-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-debuginfo-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-debuginfo-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-debuginfo-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-debugsource-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-debugsource-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-debugsource-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-debugsource-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-devel-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-devel-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-devel-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-devel-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-embedded-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-embedded-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-embedded-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-embedded-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-embedded-debuginfo-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-embedded-debuginfo-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-embedded-debuginfo-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-embedded-debuginfo-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-embedded-devel-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-embedded-devel-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-embedded-devel-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-embedded-devel-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-errmsg-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-errmsg-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-errmsg-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-errmsg-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-gssapi-server-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-gssapi-server-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-gssapi-server-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-gssapi-server-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-gssapi-server-debuginfo-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-gssapi-server-debuginfo-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-gssapi-server-debuginfo-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-gssapi-server-debuginfo-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-oqgraph-engine-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-oqgraph-engine-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-oqgraph-engine-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-oqgraph-engine-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-oqgraph-engine-debuginfo-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-oqgraph-engine-debuginfo-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-oqgraph-engine-debuginfo-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-oqgraph-engine-debuginfo-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-server-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-server-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-server-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-server-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-server-debuginfo-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-server-debuginfo-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-server-debuginfo-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-server-debuginfo-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-server-galera-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-server-galera-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-server-galera-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-server-galera-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-server-utils-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-server-utils-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-server-utils-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-server-utils-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-server-utils-debuginfo-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-server-utils-debuginfo-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-server-utils-debuginfo-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-server-utils-debuginfo-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-test-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-test-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-test-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-test-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-test-debuginfo-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-test-debuginfo-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-test-debuginfo-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.2.0.Z.EUS:mariadb:10.3:8020020201214133105:4cda2c84:mariadb-test-debuginfo-3:10.3.27-3.module+el8.2.0+9158+b3fb2ef4.x86_64	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2019-2974

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.6.45 and prior, 5.7.27 and prior and 8.0.17 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

6.5 (Medium)


                
                  CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 116 products, the same list as for CVE-2019-2938

Threats

Impact Moderate

CVE-2020-2574

Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.46 and prior, 5.7.28 and prior and 8.0.18 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client. CVSS 3.0 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-400 - Uncontrolled Resource Consumption

Affected products

Fixed 116 products, the same list as for CVE-2019-2938

Threats

Impact Low

CVE-2020-2752

Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.47 and prior, 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).

5.3 (Medium)


                
                  CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 116 products, the same list as for CVE-2019-2938

Threats

Impact Moderate

CVE-2020-2760

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).

5.5 (Medium)


                
                  CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H

Affected products

Fixed 116 products, the same list as for CVE-2019-2938

Threats

Impact Moderate

CVE-2020-2780

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

6.5 (Medium)


                
                  CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 116 products, the same list as for CVE-2019-2938

Threats

Impact Moderate

CVE-2020-2812

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

4.9 (Medium)


                
                  CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 116 products, the same list as for CVE-2019-2938

Threats

Impact Moderate

CVE-2020-2814

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.6.47 and prior, 5.7.28 and prior and 8.0.18 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

4.9 (Medium)


                
                  CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 116 products, the same list as for CVE-2019-2938

Threats

Impact Moderate

CVE-2020-13249

libmariadb/mariadb_lib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an OK packet received from a server. NOTE: although mariadb_lib.c was originally based on code shipped for MySQL, this issue does not affect any MySQL components supported by Oracle.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 116 products, the same list as for CVE-2019-2938

Threats

Impact Moderate

CVE-2020-14765

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 116 products, the same list as for CVE-2019-2938

Threats

Impact Moderate

CVE-2020-14776

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

4.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 116 products, the same list as for CVE-2019-2938

Threats

Impact Moderate

CVE-2020-14789

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affected are 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

4.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 116 products, the same list as for CVE-2019-2938

Threats

Impact Moderate

CVE-2020-14812

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Locking). Supported versions that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

4.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 116 products, the same list as for CVE-2019-2938

Threats

Impact Moderate

CVE-2020-15180

A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and availability. This flaw affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before 10.4.15 and before 10.5.6.

9.0 (Critical)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE-96 - Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')

Affected products

Fixed 116 products, the same list as for CVE-2019-2938

Threats

Impact Important

CVE-2021-2022

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.6.50 and prior, 5.7.32 and prior and 8.0.22 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

4.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 116 products, the same list as for CVE-2019-2938

Threats

Impact Moderate

CVE-2021-2144

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

7.2 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

Fixed 116 products, the same list as for CVE-2019-2938

Threats

Impact Important

CVE-2021-2194

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

4.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 116 products, the same list as for CVE-2019-2938

Threats

Impact Moderate

References

97 references

URL	Category
https://access.redhat.com/errata/RHSA-2020:5654	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=1764680	external
https://bugzilla.redhat.com/show_bug.cgi?id=1764691	external
https://bugzilla.redhat.com/show_bug.cgi?id=1798587	external
https://bugzilla.redhat.com/show_bug.cgi?id=1830056	external
https://bugzilla.redhat.com/show_bug.cgi?id=1830059	external
https://bugzilla.redhat.com/show_bug.cgi?id=1830060	external
https://bugzilla.redhat.com/show_bug.cgi?id=1830082	external
https://bugzilla.redhat.com/show_bug.cgi?id=1835849	external
https://bugzilla.redhat.com/show_bug.cgi?id=1839827	external
https://bugzilla.redhat.com/show_bug.cgi?id=1890738	external
https://bugzilla.redhat.com/show_bug.cgi?id=1890743	external
https://bugzilla.redhat.com/show_bug.cgi?id=1890747	external
https://bugzilla.redhat.com/show_bug.cgi?id=1890756	external
https://bugzilla.redhat.com/show_bug.cgi?id=1894919	external
https://bugzilla.redhat.com/show_bug.cgi?id=1899010	external
https://bugzilla.redhat.com/show_bug.cgi?id=1899018	external
https://bugzilla.redhat.com/show_bug.cgi?id=1899022	external
https://bugzilla.redhat.com/show_bug.cgi?id=1899083	external
https://bugzilla.redhat.com/show_bug.cgi?id=1899087	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2019-2938	self
https://bugzilla.redhat.com/show_bug.cgi?id=1764680	external
https://www.cve.org/CVERecord?id=CVE-2019-2938	external
https://nvd.nist.gov/vuln/detail/CVE-2019-2938	external
http://www.oracle.com/technetwork/security-adviso…	external
https://access.redhat.com/security/cve/CVE-2019-2974	self
https://bugzilla.redhat.com/show_bug.cgi?id=1764691	external
https://www.cve.org/CVERecord?id=CVE-2019-2974	external
https://nvd.nist.gov/vuln/detail/CVE-2019-2974	external
https://access.redhat.com/security/cve/CVE-2020-2574	self
https://bugzilla.redhat.com/show_bug.cgi?id=1798587	external
https://www.cve.org/CVERecord?id=CVE-2020-2574	external
https://nvd.nist.gov/vuln/detail/CVE-2020-2574	external
https://www.oracle.com/security-alerts/cpujan2020.html	external
https://access.redhat.com/security/cve/CVE-2020-2752	self
https://bugzilla.redhat.com/show_bug.cgi?id=1835849	external
https://www.cve.org/CVERecord?id=CVE-2020-2752	external
https://nvd.nist.gov/vuln/detail/CVE-2020-2752	external
https://www.oracle.com/security-alerts/cpuapr2020…	external
https://access.redhat.com/security/cve/CVE-2020-2760	self
https://bugzilla.redhat.com/show_bug.cgi?id=1830082	external
https://www.cve.org/CVERecord?id=CVE-2020-2760	external
https://nvd.nist.gov/vuln/detail/CVE-2020-2760	external
https://www.oracle.com/security-alerts/cpuapr2020.html	external
https://access.redhat.com/security/cve/CVE-2020-2780	self
https://bugzilla.redhat.com/show_bug.cgi?id=1830056	external
https://www.cve.org/CVERecord?id=CVE-2020-2780	external
https://nvd.nist.gov/vuln/detail/CVE-2020-2780	external
https://access.redhat.com/security/cve/CVE-2020-2812	self
https://bugzilla.redhat.com/show_bug.cgi?id=1830059	external
https://www.cve.org/CVERecord?id=CVE-2020-2812	external
https://nvd.nist.gov/vuln/detail/CVE-2020-2812	external
https://access.redhat.com/security/cve/CVE-2020-2814	self
https://bugzilla.redhat.com/show_bug.cgi?id=1830060	external
https://www.cve.org/CVERecord?id=CVE-2020-2814	external
https://nvd.nist.gov/vuln/detail/CVE-2020-2814	external
https://access.redhat.com/security/cve/CVE-2020-13249	self
https://bugzilla.redhat.com/show_bug.cgi?id=1839827	external
https://www.cve.org/CVERecord?id=CVE-2020-13249	external
https://nvd.nist.gov/vuln/detail/CVE-2020-13249	external
https://access.redhat.com/security/cve/CVE-2020-14765	self
https://bugzilla.redhat.com/show_bug.cgi?id=1890738	external
https://www.cve.org/CVERecord?id=CVE-2020-14765	external
https://nvd.nist.gov/vuln/detail/CVE-2020-14765	external
https://www.oracle.com/security-alerts/cpuoct2020…	external
https://access.redhat.com/security/cve/CVE-2020-14776	self
https://bugzilla.redhat.com/show_bug.cgi?id=1890743	external
https://www.cve.org/CVERecord?id=CVE-2020-14776	external
https://nvd.nist.gov/vuln/detail/CVE-2020-14776	external
https://access.redhat.com/security/cve/CVE-2020-14789	self
https://bugzilla.redhat.com/show_bug.cgi?id=1890747	external
https://www.cve.org/CVERecord?id=CVE-2020-14789	external
https://nvd.nist.gov/vuln/detail/CVE-2020-14789	external
https://access.redhat.com/security/cve/CVE-2020-14812	self
https://bugzilla.redhat.com/show_bug.cgi?id=1890756	external
https://www.cve.org/CVERecord?id=CVE-2020-14812	external
https://nvd.nist.gov/vuln/detail/CVE-2020-14812	external
https://access.redhat.com/security/cve/CVE-2020-15180	self
https://bugzilla.redhat.com/show_bug.cgi?id=1894919	external
https://www.cve.org/CVERecord?id=CVE-2020-15180	external
https://nvd.nist.gov/vuln/detail/CVE-2020-15180	external
https://access.redhat.com/security/cve/CVE-2021-2022	self
https://bugzilla.redhat.com/show_bug.cgi?id=1922389	external
https://www.cve.org/CVERecord?id=CVE-2021-2022	external
https://nvd.nist.gov/vuln/detail/CVE-2021-2022	external
https://www.oracle.com/security-alerts/cpujan2021…	external
https://access.redhat.com/security/cve/CVE-2021-2144	self
https://bugzilla.redhat.com/show_bug.cgi?id=1951749	external
https://www.cve.org/CVERecord?id=CVE-2021-2144	external
https://nvd.nist.gov/vuln/detail/CVE-2021-2144	external
https://www.oracle.com/security-alerts/cpuapr2021…	external
https://access.redhat.com/security/cve/CVE-2021-2194	self
https://bugzilla.redhat.com/show_bug.cgi?id=1951764	external
https://www.cve.org/CVERecord?id=CVE-2021-2194	external
https://nvd.nist.gov/vuln/detail/CVE-2021-2194	external

JSON

To clipboard

Loading 1.0 MB of JSON…

CVE-2019-2938 (GCVE-0-2019-2938)

Vulnerability from cvelistv5 – Published: 2019-10-16 17:40 – Updated: 2024-10-01 16:31

Summary

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-01 16:14 UTC

CWE

Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.

Assigner

oracle mitre root

References

9 references

URL	Tags
http://www.oracle.com/technetwork/security-adviso…	x_refsource_MISC
https://security.netapp.com/advisory/ntap-2019101…	x_refsource_CONFIRM
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://usn.ubuntu.com/4195-1/	vendor-advisoryx_refsource_UBUNTU
https://usn.ubuntu.com/4195-2/	vendor-advisoryx_refsource_UBUNTU
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://security.gentoo.org/glsa/202105-27	vendor-advisoryx_refsource_GENTOO

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	MySQL Server	Affected: 5.7.27 and prior Affected: 8.0.17 and prior

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T19:03:43.447Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20191017-0002/"
          },
          {
            "name": "FEDORA-2019-c1fab3f139",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7X5D3O4TOQ57KL5FLQEXH2JB2UQYHCUZ/"
          },
          {
            "name": "FEDORA-2019-d40df38271",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6DTUCXX5XXPNPFV2PHP6IESGTCFMZOFP/"
          },
          {
            "name": "FEDORA-2019-48a0a07033",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MKCJLNRK6RHFAHV7ZFD3XO7HNSBU3XOL/"
          },
          {
            "name": "USN-4195-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4195-1/"
          },
          {
            "name": "USN-4195-2",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4195-2/"
          },
          {
            "name": "openSUSE-SU-2019:2698",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00037.html"
          },
          {
            "name": "GLSA-202105-27",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202105-27"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2019-2938",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-01T16:14:59.266738Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-01T16:31:06.424Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "5.7.27 and prior"
            },
            {
              "status": "affected",
              "version": "8.0.17 and prior"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-05-26T11:08:01.000Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20191017-0002/"
        },
        {
          "name": "FEDORA-2019-c1fab3f139",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7X5D3O4TOQ57KL5FLQEXH2JB2UQYHCUZ/"
        },
        {
          "name": "FEDORA-2019-d40df38271",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6DTUCXX5XXPNPFV2PHP6IESGTCFMZOFP/"
        },
        {
          "name": "FEDORA-2019-48a0a07033",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MKCJLNRK6RHFAHV7ZFD3XO7HNSBU3XOL/"
        },
        {
          "name": "USN-4195-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4195-1/"
        },
        {
          "name": "USN-4195-2",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4195-2/"
        },
        {
          "name": "openSUSE-SU-2019:2698",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00037.html"
        },
        {
          "name": "GLSA-202105-27",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202105-27"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2019-2938",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "MySQL Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "5.7.27 and prior"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "8.0.17 and prior"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html",
              "refsource": "MISC",
              "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20191017-0002/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20191017-0002/"
            },
            {
              "name": "FEDORA-2019-c1fab3f139",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7X5D3O4TOQ57KL5FLQEXH2JB2UQYHCUZ/"
            },
            {
              "name": "FEDORA-2019-d40df38271",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6DTUCXX5XXPNPFV2PHP6IESGTCFMZOFP/"
            },
            {
              "name": "FEDORA-2019-48a0a07033",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MKCJLNRK6RHFAHV7ZFD3XO7HNSBU3XOL/"
            },
            {
              "name": "USN-4195-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4195-1/"
            },
            {
              "name": "USN-4195-2",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4195-2/"
            },
            {
              "name": "openSUSE-SU-2019:2698",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00037.html"
            },
            {
              "name": "GLSA-202105-27",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202105-27"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2019-2938",
    "datePublished": "2019-10-16T17:40:55.000Z",
    "dateReserved": "2018-12-14T00:00:00.000Z",
    "dateUpdated": "2024-10-01T16:31:06.424Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-2974 (GCVE-0-2019-2974)

Vulnerability from cvelistv5 – Published: 2019-10-16 17:40 – Updated: 2024-10-01 16:27

Summary

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-01 16:14 UTC

CWE

Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.

Assigner

oracle mitre root

References

9 references

URL	Tags
http://www.oracle.com/technetwork/security-adviso…	x_refsource_MISC
https://security.netapp.com/advisory/ntap-2019101…	x_refsource_CONFIRM
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://usn.ubuntu.com/4195-1/	vendor-advisoryx_refsource_UBUNTU
https://usn.ubuntu.com/4195-2/	vendor-advisoryx_refsource_UBUNTU
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://security.gentoo.org/glsa/202105-27	vendor-advisoryx_refsource_GENTOO

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	MySQL Server	Affected: 5.6.45 and prior Affected: 5.7.27 and prior Affected: 8.0.17 and prior

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T19:03:43.609Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20191017-0002/"
          },
          {
            "name": "FEDORA-2019-c1fab3f139",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7X5D3O4TOQ57KL5FLQEXH2JB2UQYHCUZ/"
          },
          {
            "name": "FEDORA-2019-d40df38271",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6DTUCXX5XXPNPFV2PHP6IESGTCFMZOFP/"
          },
          {
            "name": "FEDORA-2019-48a0a07033",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MKCJLNRK6RHFAHV7ZFD3XO7HNSBU3XOL/"
          },
          {
            "name": "USN-4195-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4195-1/"
          },
          {
            "name": "USN-4195-2",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4195-2/"
          },
          {
            "name": "openSUSE-SU-2019:2698",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00037.html"
          },
          {
            "name": "GLSA-202105-27",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202105-27"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2019-2974",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-01T16:14:06.391758Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-01T16:27:00.655Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "5.6.45 and prior"
            },
            {
              "status": "affected",
              "version": "5.7.27 and prior"
            },
            {
              "status": "affected",
              "version": "8.0.17 and prior"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.6.45 and prior, 5.7.27 and prior and 8.0.17 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-05-26T11:06:47.000Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20191017-0002/"
        },
        {
          "name": "FEDORA-2019-c1fab3f139",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7X5D3O4TOQ57KL5FLQEXH2JB2UQYHCUZ/"
        },
        {
          "name": "FEDORA-2019-d40df38271",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6DTUCXX5XXPNPFV2PHP6IESGTCFMZOFP/"
        },
        {
          "name": "FEDORA-2019-48a0a07033",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MKCJLNRK6RHFAHV7ZFD3XO7HNSBU3XOL/"
        },
        {
          "name": "USN-4195-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4195-1/"
        },
        {
          "name": "USN-4195-2",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4195-2/"
        },
        {
          "name": "openSUSE-SU-2019:2698",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00037.html"
        },
        {
          "name": "GLSA-202105-27",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202105-27"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2019-2974",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "MySQL Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "5.6.45 and prior"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "5.7.27 and prior"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "8.0.17 and prior"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.6.45 and prior, 5.7.27 and prior and 8.0.17 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html",
              "refsource": "MISC",
              "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20191017-0002/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20191017-0002/"
            },
            {
              "name": "FEDORA-2019-c1fab3f139",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7X5D3O4TOQ57KL5FLQEXH2JB2UQYHCUZ/"
            },
            {
              "name": "FEDORA-2019-d40df38271",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6DTUCXX5XXPNPFV2PHP6IESGTCFMZOFP/"
            },
            {
              "name": "FEDORA-2019-48a0a07033",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MKCJLNRK6RHFAHV7ZFD3XO7HNSBU3XOL/"
            },
            {
              "name": "USN-4195-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4195-1/"
            },
            {
              "name": "USN-4195-2",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4195-2/"
            },
            {
              "name": "openSUSE-SU-2019:2698",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00037.html"
            },
            {
              "name": "GLSA-202105-27",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202105-27"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2019-2974",
    "datePublished": "2019-10-16T17:40:57.000Z",
    "dateReserved": "2018-12-14T00:00:00.000Z",
    "dateUpdated": "2024-10-01T16:27:00.655Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-13249 (GCVE-0-2020-13249)

Vulnerability from cvelistv5 – Published: 2020-05-20 18:48 – Updated: 2024-08-04 12:11

Summary

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

6 references

URL	Tags
https://github.com/mariadb-corporation/mariadb-co…	x_refsource_MISC
https://github.com/mariadb-corporation/mariadb-co…	x_refsource_MISC
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:11:19.465Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/mariadb-corporation/mariadb-connector-c/commit/2759b87d72926b7c9b5426437a7c8dd15ff57945"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/mariadb-corporation/mariadb-connector-c/compare/v3.1.7...v3.1.8"
          },
          {
            "name": "openSUSE-SU-2020:0738",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00064.html"
          },
          {
            "name": "FEDORA-2020-35f52d9370",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UW2ED32VEUHXFN2J3YQE27JIBV4SC2PI/"
          },
          {
            "name": "openSUSE-SU-2020:0870",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00054.html"
          },
          {
            "name": "FEDORA-2020-ac2d47d89a",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4X2BMF3EILMTXGOZDTPYS3KT5VWLA2P/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "libmariadb/mariadb_lib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an OK packet received from a server. NOTE: although mariadb_lib.c was originally based on code shipped for MySQL, this issue does not affect any MySQL components supported by Oracle."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-11-11T02:06:34.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-c/commit/2759b87d72926b7c9b5426437a7c8dd15ff57945"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-c/compare/v3.1.7...v3.1.8"
        },
        {
          "name": "openSUSE-SU-2020:0738",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00064.html"
        },
        {
          "name": "FEDORA-2020-35f52d9370",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UW2ED32VEUHXFN2J3YQE27JIBV4SC2PI/"
        },
        {
          "name": "openSUSE-SU-2020:0870",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00054.html"
        },
        {
          "name": "FEDORA-2020-ac2d47d89a",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4X2BMF3EILMTXGOZDTPYS3KT5VWLA2P/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-13249",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "libmariadb/mariadb_lib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an OK packet received from a server. NOTE: although mariadb_lib.c was originally based on code shipped for MySQL, this issue does not affect any MySQL components supported by Oracle."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/mariadb-corporation/mariadb-connector-c/commit/2759b87d72926b7c9b5426437a7c8dd15ff57945",
              "refsource": "MISC",
              "url": "https://github.com/mariadb-corporation/mariadb-connector-c/commit/2759b87d72926b7c9b5426437a7c8dd15ff57945"
            },
            {
              "name": "https://github.com/mariadb-corporation/mariadb-connector-c/compare/v3.1.7...v3.1.8",
              "refsource": "MISC",
              "url": "https://github.com/mariadb-corporation/mariadb-connector-c/compare/v3.1.7...v3.1.8"
            },
            {
              "name": "openSUSE-SU-2020:0738",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00064.html"
            },
            {
              "name": "FEDORA-2020-35f52d9370",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UW2ED32VEUHXFN2J3YQE27JIBV4SC2PI/"
            },
            {
              "name": "openSUSE-SU-2020:0870",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00054.html"
            },
            {
              "name": "FEDORA-2020-ac2d47d89a",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X4X2BMF3EILMTXGOZDTPYS3KT5VWLA2P/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-13249",
    "datePublished": "2020-05-20T18:48:12.000Z",
    "dateReserved": "2020-05-20T00:00:00.000Z",
    "dateUpdated": "2024-08-04T12:11:19.465Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-14765 (GCVE-0-2020-14765)

Vulnerability from cvelistv5 – Published: 2020-10-21 14:04 – Updated: 2024-09-26 20:27

Summary

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-26 19:45 UTC

CWE

Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.

Assigner

oracle mitre root

References

10 references

URL	Tags
https://www.oracle.com/security-alerts/cpuoct2020.html	x_refsource_MISC
https://security.netapp.com/advisory/ntap-2020102…	x_refsource_CONFIRM
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.debian.org/debian-lts-announce/2021…	mailing-listx_refsource_MLIST
https://security.gentoo.org/glsa/202105-27	vendor-advisoryx_refsource_GENTOO

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	MySQL Server	Affected: 5.6.49 and prior Affected: 5.7.31 and prior Affected: 8.0.21 and prior

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:53:43.316Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20201023-0003/"
          },
          {
            "name": "FEDORA-2020-eee64a579c",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O7RVY2Z7HYQHFJXBGARXUAGKUDAWYPP4/"
          },
          {
            "name": "FEDORA-2020-4f9ee82bc5",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GZU3PA5XJXNQ4C4F6435ARM6WKM3OZYR/"
          },
          {
            "name": "FEDORA-2020-53df1c05be",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVS6KNVBZCLZBKNJ5JA2PGAG3NTOJVH6/"
          },
          {
            "name": "FEDORA-2020-561eed63ef",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPW5YMZR5C7D7NBZQSTDOB3XAI5QP32Y/"
          },
          {
            "name": "FEDORA-2020-b995eb2973",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JBZZ3XIRPFPAWBZLYBN777ANXSFXAPPB/"
          },
          {
            "name": "FEDORA-2020-ac2d47d89a",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4X2BMF3EILMTXGOZDTPYS3KT5VWLA2P/"
          },
          {
            "name": "[debian-lts-announce] 20210131 [SECURITY] [DLA 2538-1] mariadb-10.1 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/01/msg00027.html"
          },
          {
            "name": "GLSA-202105-27",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202105-27"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-14765",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-26T19:45:03.867584Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-26T20:27:04.331Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "5.6.49 and prior"
            },
            {
              "status": "affected",
              "version": "5.7.31 and prior"
            },
            {
              "status": "affected",
              "version": "8.0.21 and prior"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-05-26T11:08:29.000Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20201023-0003/"
        },
        {
          "name": "FEDORA-2020-eee64a579c",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O7RVY2Z7HYQHFJXBGARXUAGKUDAWYPP4/"
        },
        {
          "name": "FEDORA-2020-4f9ee82bc5",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GZU3PA5XJXNQ4C4F6435ARM6WKM3OZYR/"
        },
        {
          "name": "FEDORA-2020-53df1c05be",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVS6KNVBZCLZBKNJ5JA2PGAG3NTOJVH6/"
        },
        {
          "name": "FEDORA-2020-561eed63ef",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPW5YMZR5C7D7NBZQSTDOB3XAI5QP32Y/"
        },
        {
          "name": "FEDORA-2020-b995eb2973",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JBZZ3XIRPFPAWBZLYBN777ANXSFXAPPB/"
        },
        {
          "name": "FEDORA-2020-ac2d47d89a",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4X2BMF3EILMTXGOZDTPYS3KT5VWLA2P/"
        },
        {
          "name": "[debian-lts-announce] 20210131 [SECURITY] [DLA 2538-1] mariadb-10.1 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/01/msg00027.html"
        },
        {
          "name": "GLSA-202105-27",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202105-27"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-14765",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "MySQL Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "5.6.49 and prior"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "5.7.31 and prior"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "8.0.21 and prior"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "6.5",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20201023-0003/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20201023-0003/"
            },
            {
              "name": "FEDORA-2020-eee64a579c",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O7RVY2Z7HYQHFJXBGARXUAGKUDAWYPP4/"
            },
            {
              "name": "FEDORA-2020-4f9ee82bc5",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GZU3PA5XJXNQ4C4F6435ARM6WKM3OZYR/"
            },
            {
              "name": "FEDORA-2020-53df1c05be",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZVS6KNVBZCLZBKNJ5JA2PGAG3NTOJVH6/"
            },
            {
              "name": "FEDORA-2020-561eed63ef",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OPW5YMZR5C7D7NBZQSTDOB3XAI5QP32Y/"
            },
            {
              "name": "FEDORA-2020-b995eb2973",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JBZZ3XIRPFPAWBZLYBN777ANXSFXAPPB/"
            },
            {
              "name": "FEDORA-2020-ac2d47d89a",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X4X2BMF3EILMTXGOZDTPYS3KT5VWLA2P/"
            },
            {
              "name": "[debian-lts-announce] 20210131 [SECURITY] [DLA 2538-1] mariadb-10.1 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/01/msg00027.html"
            },
            {
              "name": "GLSA-202105-27",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202105-27"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-14765",
    "datePublished": "2020-10-21T14:04:24.000Z",
    "dateReserved": "2020-06-19T00:00:00.000Z",
    "dateUpdated": "2024-09-26T20:27:04.331Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-14776 (GCVE-0-2020-14776)

Vulnerability from cvelistv5 – Published: 2020-10-21 14:04 – Updated: 2024-09-26 20:25

Summary

Severity

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-26 19:44 UTC

CWE

Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.

Assigner

oracle mitre root

References

9 references

URL	Tags
https://www.oracle.com/security-alerts/cpuoct2020.html	x_refsource_MISC
https://security.netapp.com/advisory/ntap-2020102…	x_refsource_CONFIRM
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://security.gentoo.org/glsa/202105-27	vendor-advisoryx_refsource_GENTOO

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	MySQL Server	Affected: 5.7.31 and prior Affected: 8.0.21 and prior

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:53:43.281Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20201023-0003/"
          },
          {
            "name": "FEDORA-2020-eee64a579c",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O7RVY2Z7HYQHFJXBGARXUAGKUDAWYPP4/"
          },
          {
            "name": "FEDORA-2020-4f9ee82bc5",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GZU3PA5XJXNQ4C4F6435ARM6WKM3OZYR/"
          },
          {
            "name": "FEDORA-2020-53df1c05be",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVS6KNVBZCLZBKNJ5JA2PGAG3NTOJVH6/"
          },
          {
            "name": "FEDORA-2020-561eed63ef",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPW5YMZR5C7D7NBZQSTDOB3XAI5QP32Y/"
          },
          {
            "name": "FEDORA-2020-b995eb2973",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JBZZ3XIRPFPAWBZLYBN777ANXSFXAPPB/"
          },
          {
            "name": "FEDORA-2020-ac2d47d89a",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4X2BMF3EILMTXGOZDTPYS3KT5VWLA2P/"
          },
          {
            "name": "GLSA-202105-27",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202105-27"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-14776",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-26T19:44:48.791599Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-26T20:25:07.299Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "5.7.31 and prior"
            },
            {
              "status": "affected",
              "version": "8.0.21 and prior"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-05-26T11:06:36.000Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20201023-0003/"
        },
        {
          "name": "FEDORA-2020-eee64a579c",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O7RVY2Z7HYQHFJXBGARXUAGKUDAWYPP4/"
        },
        {
          "name": "FEDORA-2020-4f9ee82bc5",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GZU3PA5XJXNQ4C4F6435ARM6WKM3OZYR/"
        },
        {
          "name": "FEDORA-2020-53df1c05be",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVS6KNVBZCLZBKNJ5JA2PGAG3NTOJVH6/"
        },
        {
          "name": "FEDORA-2020-561eed63ef",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPW5YMZR5C7D7NBZQSTDOB3XAI5QP32Y/"
        },
        {
          "name": "FEDORA-2020-b995eb2973",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JBZZ3XIRPFPAWBZLYBN777ANXSFXAPPB/"
        },
        {
          "name": "FEDORA-2020-ac2d47d89a",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4X2BMF3EILMTXGOZDTPYS3KT5VWLA2P/"
        },
        {
          "name": "GLSA-202105-27",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202105-27"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-14776",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "MySQL Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "5.7.31 and prior"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "8.0.21 and prior"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "4.9",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20201023-0003/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20201023-0003/"
            },
            {
              "name": "FEDORA-2020-eee64a579c",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O7RVY2Z7HYQHFJXBGARXUAGKUDAWYPP4/"
            },
            {
              "name": "FEDORA-2020-4f9ee82bc5",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GZU3PA5XJXNQ4C4F6435ARM6WKM3OZYR/"
            },
            {
              "name": "FEDORA-2020-53df1c05be",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZVS6KNVBZCLZBKNJ5JA2PGAG3NTOJVH6/"
            },
            {
              "name": "FEDORA-2020-561eed63ef",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OPW5YMZR5C7D7NBZQSTDOB3XAI5QP32Y/"
            },
            {
              "name": "FEDORA-2020-b995eb2973",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JBZZ3XIRPFPAWBZLYBN777ANXSFXAPPB/"
            },
            {
              "name": "FEDORA-2020-ac2d47d89a",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X4X2BMF3EILMTXGOZDTPYS3KT5VWLA2P/"
            },
            {
              "name": "GLSA-202105-27",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202105-27"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-14776",
    "datePublished": "2020-10-21T14:04:24.000Z",
    "dateReserved": "2020-06-19T00:00:00.000Z",
    "dateUpdated": "2024-09-26T20:25:07.299Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-14789 (GCVE-0-2020-14789)

Vulnerability from cvelistv5 – Published: 2020-10-21 14:04 – Updated: 2024-09-26 20:22

Summary

Severity

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-26 19:44 UTC

CWE

Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.

Assigner

oracle mitre root

References

9 references

URL	Tags
https://www.oracle.com/security-alerts/cpuoct2020.html	x_refsource_MISC
https://security.netapp.com/advisory/ntap-2020102…	x_refsource_CONFIRM
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://security.gentoo.org/glsa/202105-27	vendor-advisoryx_refsource_GENTOO

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	MySQL Server	Affected: 5.7.31 and prior Affected: 8.0.21 and prior

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:53:43.346Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20201023-0003/"
          },
          {
            "name": "FEDORA-2020-eee64a579c",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O7RVY2Z7HYQHFJXBGARXUAGKUDAWYPP4/"
          },
          {
            "name": "FEDORA-2020-4f9ee82bc5",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GZU3PA5XJXNQ4C4F6435ARM6WKM3OZYR/"
          },
          {
            "name": "FEDORA-2020-53df1c05be",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVS6KNVBZCLZBKNJ5JA2PGAG3NTOJVH6/"
          },
          {
            "name": "FEDORA-2020-561eed63ef",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPW5YMZR5C7D7NBZQSTDOB3XAI5QP32Y/"
          },
          {
            "name": "FEDORA-2020-b995eb2973",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JBZZ3XIRPFPAWBZLYBN777ANXSFXAPPB/"
          },
          {
            "name": "FEDORA-2020-ac2d47d89a",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4X2BMF3EILMTXGOZDTPYS3KT5VWLA2P/"
          },
          {
            "name": "GLSA-202105-27",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202105-27"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-14789",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-26T19:44:31.156195Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-26T20:22:46.476Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "5.7.31 and prior"
            },
            {
              "status": "affected",
              "version": "8.0.21 and prior"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affected are 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-05-26T11:07:17.000Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20201023-0003/"
        },
        {
          "name": "FEDORA-2020-eee64a579c",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O7RVY2Z7HYQHFJXBGARXUAGKUDAWYPP4/"
        },
        {
          "name": "FEDORA-2020-4f9ee82bc5",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GZU3PA5XJXNQ4C4F6435ARM6WKM3OZYR/"
        },
        {
          "name": "FEDORA-2020-53df1c05be",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVS6KNVBZCLZBKNJ5JA2PGAG3NTOJVH6/"
        },
        {
          "name": "FEDORA-2020-561eed63ef",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPW5YMZR5C7D7NBZQSTDOB3XAI5QP32Y/"
        },
        {
          "name": "FEDORA-2020-b995eb2973",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JBZZ3XIRPFPAWBZLYBN777ANXSFXAPPB/"
        },
        {
          "name": "FEDORA-2020-ac2d47d89a",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4X2BMF3EILMTXGOZDTPYS3KT5VWLA2P/"
        },
        {
          "name": "GLSA-202105-27",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202105-27"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-14789",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "MySQL Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "5.7.31 and prior"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "8.0.21 and prior"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affected are 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "4.9",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20201023-0003/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20201023-0003/"
            },
            {
              "name": "FEDORA-2020-eee64a579c",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O7RVY2Z7HYQHFJXBGARXUAGKUDAWYPP4/"
            },
            {
              "name": "FEDORA-2020-4f9ee82bc5",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GZU3PA5XJXNQ4C4F6435ARM6WKM3OZYR/"
            },
            {
              "name": "FEDORA-2020-53df1c05be",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZVS6KNVBZCLZBKNJ5JA2PGAG3NTOJVH6/"
            },
            {
              "name": "FEDORA-2020-561eed63ef",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OPW5YMZR5C7D7NBZQSTDOB3XAI5QP32Y/"
            },
            {
              "name": "FEDORA-2020-b995eb2973",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JBZZ3XIRPFPAWBZLYBN777ANXSFXAPPB/"
            },
            {
              "name": "FEDORA-2020-ac2d47d89a",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X4X2BMF3EILMTXGOZDTPYS3KT5VWLA2P/"
            },
            {
              "name": "GLSA-202105-27",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202105-27"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-14789",
    "datePublished": "2020-10-21T14:04:25.000Z",
    "dateReserved": "2020-06-19T00:00:00.000Z",
    "dateUpdated": "2024-09-26T20:22:46.476Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-14812 (GCVE-0-2020-14812)

Vulnerability from cvelistv5 – Published: 2020-10-21 14:04 – Updated: 2024-09-26 20:18

Summary

Severity

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-26 19:44 UTC

CWE

Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.

Assigner

oracle mitre root

References

7 references

URL	Tags
https://www.oracle.com/security-alerts/cpuoct2020.html	x_refsource_MISC
https://security.netapp.com/advisory/ntap-2020102…	x_refsource_CONFIRM
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.debian.org/debian-lts-announce/2021…	mailing-listx_refsource_MLIST
https://security.gentoo.org/glsa/202105-27	vendor-advisoryx_refsource_GENTOO

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	MySQL Server	Affected: 5.6.49 and prior Affected: 5.7.31 and prior Affected: 8.0.21 and prior

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T13:00:50.930Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20201023-0003/"
          },
          {
            "name": "FEDORA-2020-561eed63ef",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPW5YMZR5C7D7NBZQSTDOB3XAI5QP32Y/"
          },
          {
            "name": "FEDORA-2020-b995eb2973",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JBZZ3XIRPFPAWBZLYBN777ANXSFXAPPB/"
          },
          {
            "name": "FEDORA-2020-ac2d47d89a",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4X2BMF3EILMTXGOZDTPYS3KT5VWLA2P/"
          },
          {
            "name": "[debian-lts-announce] 20210131 [SECURITY] [DLA 2538-1] mariadb-10.1 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/01/msg00027.html"
          },
          {
            "name": "GLSA-202105-27",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202105-27"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-14812",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-26T19:44:03.632075Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-26T20:18:51.689Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "5.6.49 and prior"
            },
            {
              "status": "affected",
              "version": "5.7.31 and prior"
            },
            {
              "status": "affected",
              "version": "8.0.21 and prior"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Locking). Supported versions that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-05-26T11:06:40.000Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20201023-0003/"
        },
        {
          "name": "FEDORA-2020-561eed63ef",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPW5YMZR5C7D7NBZQSTDOB3XAI5QP32Y/"
        },
        {
          "name": "FEDORA-2020-b995eb2973",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JBZZ3XIRPFPAWBZLYBN777ANXSFXAPPB/"
        },
        {
          "name": "FEDORA-2020-ac2d47d89a",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4X2BMF3EILMTXGOZDTPYS3KT5VWLA2P/"
        },
        {
          "name": "[debian-lts-announce] 20210131 [SECURITY] [DLA 2538-1] mariadb-10.1 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/01/msg00027.html"
        },
        {
          "name": "GLSA-202105-27",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202105-27"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-14812",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "MySQL Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "5.6.49 and prior"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "5.7.31 and prior"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "8.0.21 and prior"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Locking). Supported versions that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "4.9",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20201023-0003/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20201023-0003/"
            },
            {
              "name": "FEDORA-2020-561eed63ef",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OPW5YMZR5C7D7NBZQSTDOB3XAI5QP32Y/"
            },
            {
              "name": "FEDORA-2020-b995eb2973",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JBZZ3XIRPFPAWBZLYBN777ANXSFXAPPB/"
            },
            {
              "name": "FEDORA-2020-ac2d47d89a",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X4X2BMF3EILMTXGOZDTPYS3KT5VWLA2P/"
            },
            {
              "name": "[debian-lts-announce] 20210131 [SECURITY] [DLA 2538-1] mariadb-10.1 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/01/msg00027.html"
            },
            {
              "name": "GLSA-202105-27",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202105-27"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-14812",
    "datePublished": "2020-10-21T14:04:26.000Z",
    "dateReserved": "2020-06-19T00:00:00.000Z",
    "dateUpdated": "2024-09-26T20:18:51.689Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-15180 (GCVE-0-2020-15180)

Vulnerability from cvelistv5 – Published: 2021-05-27 19:45 – Updated: 2024-08-04 13:08

Summary

Severity

No CVSS data available.

CWE

CWE-20 - >CWE-96

Assigner

GitHub_M mitre root

References

5 references

URL	Tags
https://lists.debian.org/debian-lts-announce/2020…	mailing-listx_refsource_MLIST
https://www.debian.org/security/2020/dsa-4776	vendor-advisoryx_refsource_DEBIAN
https://security.gentoo.org/glsa/202011-14	vendor-advisoryx_refsource_GENTOO
https://www.percona.com/blog/2020/10/30/cve-2020-…	x_refsource_CONFIRM
https://bugzilla.redhat.com/show_bug.cgi?id=1894919	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
n/a	mariadb	Affected: mariadb 10.1.47, mariadb 10.2.34, mariadb 10.3.25, mariadb 10.4.15, mariadb 10.5.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T13:08:22.425Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[debian-lts-announce] 20201021 [SECURITY] [DLA 2409-1] mariadb-10.1 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00021.html"
          },
          {
            "name": "DSA-4776",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4776"
          },
          {
            "name": "GLSA-202011-14",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202011-14"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.percona.com/blog/2020/10/30/cve-2020-15180-affects-percona-xtradb-cluster/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1894919"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mariadb",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "mariadb 10.1.47, mariadb 10.2.34, mariadb 10.3.25, mariadb 10.4.15, mariadb 10.5.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system\u0027s confidentiality, integrity, and availability. This flaw affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before 10.4.15 and before 10.5.6."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20-\u003eCWE-96",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-05-27T19:57:09.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "[debian-lts-announce] 20201021 [SECURITY] [DLA 2409-1] mariadb-10.1 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00021.html"
        },
        {
          "name": "DSA-4776",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4776"
        },
        {
          "name": "GLSA-202011-14",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202011-14"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.percona.com/blog/2020/10/30/cve-2020-15180-affects-percona-xtradb-cluster/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1894919"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-15180",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "mariadb",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "mariadb 10.1.47, mariadb 10.2.34, mariadb 10.3.25, mariadb 10.4.15, mariadb 10.5.6"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system\u0027s confidentiality, integrity, and availability. This flaw affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before 10.4.15 and before 10.5.6."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-20-\u003eCWE-96"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[debian-lts-announce] 20201021 [SECURITY] [DLA 2409-1] mariadb-10.1 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00021.html"
            },
            {
              "name": "DSA-4776",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4776"
            },
            {
              "name": "GLSA-202011-14",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202011-14"
            },
            {
              "name": "https://www.percona.com/blog/2020/10/30/cve-2020-15180-affects-percona-xtradb-cluster/",
              "refsource": "CONFIRM",
              "url": "https://www.percona.com/blog/2020/10/30/cve-2020-15180-affects-percona-xtradb-cluster/"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1894919",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1894919"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2020-15180",
    "datePublished": "2021-05-27T19:45:28.000Z",
    "dateReserved": "2020-06-25T00:00:00.000Z",
    "dateUpdated": "2024-08-04T13:08:22.425Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-2574 (GCVE-0-2020-2574)

Vulnerability from cvelistv5 – Published: 2020-01-15 16:34 – Updated: 2024-09-30 16:33

Summary

Severity

5.9 (Medium)


                        
                          CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-30 15:05 UTC

CWE

Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client.

Assigner

oracle mitre root

References

7 references

URL	Tags
https://www.oracle.com/security-alerts/cpujan2020.html	x_refsource_MISC
https://security.netapp.com/advisory/ntap-2020012…	x_refsource_CONFIRM
https://usn.ubuntu.com/4250-1/	vendor-advisoryx_refsource_UBUNTU
https://usn.ubuntu.com/4250-2/	vendor-advisoryx_refsource_UBUNTU
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://www.openwall.com/lists/oss-security/2020/09/29/1	mailing-listx_refsource_MLIST
https://security.gentoo.org/glsa/202105-27	vendor-advisoryx_refsource_GENTOO

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	MySQL Server	Affected: 5.6.46 and prior Affected: 5.7.28 and prior Affected: 8.0.18 and prior

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T07:09:54.709Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200122-0002/"
          },
          {
            "name": "USN-4250-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4250-1/"
          },
          {
            "name": "USN-4250-2",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4250-2/"
          },
          {
            "name": "openSUSE-SU-2020:0289",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00007.html"
          },
          {
            "name": "[oss-security] 20200929 QEMU: NULL pointer derefrence issues",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2020/09/29/1"
          },
          {
            "name": "GLSA-202105-27",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202105-27"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-2574",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-30T15:05:04.106828Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-30T16:33:42.729Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "5.6.46 and prior"
            },
            {
              "status": "affected",
              "version": "5.7.28 and prior"
            },
            {
              "status": "affected",
              "version": "8.0.18 and prior"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.46 and prior, 5.7.28 and prior and 8.0.18 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client. CVSS 3.0 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-05-26T11:06:24.000Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200122-0002/"
        },
        {
          "name": "USN-4250-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4250-1/"
        },
        {
          "name": "USN-4250-2",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4250-2/"
        },
        {
          "name": "openSUSE-SU-2020:0289",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00007.html"
        },
        {
          "name": "[oss-security] 20200929 QEMU: NULL pointer derefrence issues",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2020/09/29/1"
        },
        {
          "name": "GLSA-202105-27",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202105-27"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-2574",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "MySQL Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "5.6.46 and prior"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "5.7.28 and prior"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "8.0.18 and prior"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.46 and prior, 5.7.28 and prior and 8.0.18 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client. CVSS 3.0 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "5.9",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200122-0002/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200122-0002/"
            },
            {
              "name": "USN-4250-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4250-1/"
            },
            {
              "name": "USN-4250-2",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4250-2/"
            },
            {
              "name": "openSUSE-SU-2020:0289",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00007.html"
            },
            {
              "name": "[oss-security] 20200929 QEMU: NULL pointer derefrence issues",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2020/09/29/1"
            },
            {
              "name": "GLSA-202105-27",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202105-27"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-2574",
    "datePublished": "2020-01-15T16:34:01.000Z",
    "dateReserved": "2019-12-10T00:00:00.000Z",
    "dateUpdated": "2024-09-30T16:33:42.729Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-2752 (GCVE-0-2020-2752)

Vulnerability from cvelistv5 – Published: 2020-04-15 13:29 – Updated: 2024-09-30 15:42

Summary

Severity

5.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-30 15:00 UTC

CWE

Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client.

Assigner

oracle mitre root

References

7 references

URL	Tags
https://www.oracle.com/security-alerts/cpuapr2020.html	x_refsource_MISC
https://security.netapp.com/advisory/ntap-2020041…	x_refsource_CONFIRM
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://security.gentoo.org/glsa/202012-08	vendor-advisoryx_refsource_GENTOO
https://security.gentoo.org/glsa/202105-27	vendor-advisoryx_refsource_GENTOO

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	MySQL Server	Affected: 5.6.47 and prior Affected: 5.7.27 and prior Affected: 8.0.17 and prior

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T07:17:02.406Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200416-0003/"
          },
          {
            "name": "FEDORA-2020-35f52d9370",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UW2ED32VEUHXFN2J3YQE27JIBV4SC2PI/"
          },
          {
            "name": "openSUSE-SU-2020:0870",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00054.html"
          },
          {
            "name": "FEDORA-2020-ac2d47d89a",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4X2BMF3EILMTXGOZDTPYS3KT5VWLA2P/"
          },
          {
            "name": "GLSA-202012-08",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202012-08"
          },
          {
            "name": "GLSA-202105-27",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202105-27"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-2752",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-30T15:00:13.789993Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-30T15:42:25.775Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "5.6.47 and prior"
            },
            {
              "status": "affected",
              "version": "5.7.27 and prior"
            },
            {
              "status": "affected",
              "version": "8.0.17 and prior"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.47 and prior, 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Client.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-05-26T11:06:52.000Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200416-0003/"
        },
        {
          "name": "FEDORA-2020-35f52d9370",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UW2ED32VEUHXFN2J3YQE27JIBV4SC2PI/"
        },
        {
          "name": "openSUSE-SU-2020:0870",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00054.html"
        },
        {
          "name": "FEDORA-2020-ac2d47d89a",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4X2BMF3EILMTXGOZDTPYS3KT5VWLA2P/"
        },
        {
          "name": "GLSA-202012-08",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202012-08"
        },
        {
          "name": "GLSA-202105-27",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202105-27"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-2752",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "MySQL Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "5.6.47 and prior"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "5.7.27 and prior"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "8.0.17 and prior"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.47 and prior, 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "5.3",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Client.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200416-0003/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200416-0003/"
            },
            {
              "name": "FEDORA-2020-35f52d9370",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UW2ED32VEUHXFN2J3YQE27JIBV4SC2PI/"
            },
            {
              "name": "openSUSE-SU-2020:0870",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00054.html"
            },
            {
              "name": "FEDORA-2020-ac2d47d89a",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X4X2BMF3EILMTXGOZDTPYS3KT5VWLA2P/"
            },
            {
              "name": "GLSA-202012-08",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202012-08"
            },
            {
              "name": "GLSA-202105-27",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202105-27"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-2752",
    "datePublished": "2020-04-15T13:29:44.000Z",
    "dateReserved": "2019-12-10T00:00:00.000Z",
    "dateUpdated": "2024-09-30T15:42:25.775Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2020_5654

CVE-2019-2938 (GCVE-0-2019-2938)

CVE-2019-2974 (GCVE-0-2019-2974)

CVE-2020-13249 (GCVE-0-2020-13249)

CVE-2020-14765 (GCVE-0-2020-14765)

CVE-2020-14776 (GCVE-0-2020-14776)

CVE-2020-14789 (GCVE-0-2020-14789)

CVE-2020-14812 (GCVE-0-2020-14812)

CVE-2020-15180 (GCVE-0-2020-15180)

CVE-2020-2574 (GCVE-0-2020-2574)

CVE-2020-2752 (GCVE-0-2020-2752)

Tags

Sightings

Nomenclature

Related by attack behaviour