RHSA-2020:5500 — Red Hat Security Advisory: mariadb:10.3 security, bug fix, and enhancement update

Fixed packages 28

Release	Package	Fixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream	galera	0:25.3.31-1.module+el8.3.0+8843+3f4e42f6
Red Hat · RHEL 8 enterprise_linux:8::appstream	galera-debuginfo	0:25.3.31-1.module+el8.3.0+8843+3f4e42f6
Red Hat · RHEL 8 enterprise_linux:8::appstream	galera-debugsource	0:25.3.31-1.module+el8.3.0+8843+3f4e42f6
Red Hat · RHEL 8 enterprise_linux:8::appstream	Judy	0:1.0.5-18.module+el8+2765+cfa4f87b
Red Hat · RHEL 8 enterprise_linux:8::appstream	Judy-debuginfo	0:1.0.5-18.module+el8+2765+cfa4f87b
Red Hat · RHEL 8 enterprise_linux:8::appstream	Judy-debugsource	0:1.0.5-18.module+el8+2765+cfa4f87b
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb	3:10.3.27-3.module+el8.3.0+8972+5e3224e9
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-backup	3:10.3.27-3.module+el8.3.0+8972+5e3224e9
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-backup-debuginfo	3:10.3.27-3.module+el8.3.0+8972+5e3224e9
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-common	3:10.3.27-3.module+el8.3.0+8972+5e3224e9
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-debuginfo	3:10.3.27-3.module+el8.3.0+8972+5e3224e9
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-debugsource	3:10.3.27-3.module+el8.3.0+8972+5e3224e9
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-devel	3:10.3.27-3.module+el8.3.0+8972+5e3224e9
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-embedded	3:10.3.27-3.module+el8.3.0+8972+5e3224e9
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-embedded-debuginfo	3:10.3.27-3.module+el8.3.0+8972+5e3224e9
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-embedded-devel	3:10.3.27-3.module+el8.3.0+8972+5e3224e9
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-errmsg	3:10.3.27-3.module+el8.3.0+8972+5e3224e9
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-gssapi-server	3:10.3.27-3.module+el8.3.0+8972+5e3224e9
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-gssapi-server-debuginfo	3:10.3.27-3.module+el8.3.0+8972+5e3224e9
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-oqgraph-engine	3:10.3.27-3.module+el8.3.0+8972+5e3224e9
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-oqgraph-engine-debuginfo	3:10.3.27-3.module+el8.3.0+8972+5e3224e9
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-server	3:10.3.27-3.module+el8.3.0+8972+5e3224e9
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-server-debuginfo	3:10.3.27-3.module+el8.3.0+8972+5e3224e9
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-server-galera	3:10.3.27-3.module+el8.3.0+8972+5e3224e9
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-server-utils	3:10.3.27-3.module+el8.3.0+8972+5e3224e9
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-server-utils-debuginfo	3:10.3.27-3.module+el8.3.0+8972+5e3224e9
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-test	3:10.3.27-3.module+el8.3.0+8972+5e3224e9
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-test-debuginfo	3:10.3.27-3.module+el8.3.0+8972+5e3224e9

Vulnerabilities 17

High 7.2

CVE-2021-2144

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affe…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Apr 22, 2021
Medium 6.5

CVE-2020-14765

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affecte…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Debian Ubuntu Alpine

Oct 21, 2020
Medium 6.5

CVE-2020-2780

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affecte…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Apr 15, 2020
Medium 5.9

CVE-2020-2574

Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are …

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Alpine

Jan 15, 2020
Medium 5.5

CVE-2020-2760

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Alpine

Apr 15, 2020
Medium 5.3

CVE-2020-2752

Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are …

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Alpine

Apr 15, 2020
Medium 4.9

CVE-2020-14776

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Debian Ubuntu Alpine

Oct 21, 2020
Medium 4.9

CVE-2020-14789

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affecte…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Debian Ubuntu Alpine

Oct 21, 2020
Medium 4.9

CVE-2020-14812

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Locking). Supported versions that are aff…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Debian Ubuntu Alpine

Oct 21, 2020
Medium 4.9

CVE-2020-2812

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions tha…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Alpine

Apr 15, 2020
Medium 4.9

CVE-2020-2814

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Alpine

Apr 15, 2020
Medium 4.9

CVE-2021-2194

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Debian Ubuntu

Apr 22, 2021
Medium 4.4

CVE-2021-2022

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Debian Ubuntu

Jan 20, 2021
Unscored —

CVE-2019-2938

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Alpine

Oct 16, 2019
Unscored —

CVE-2019-2974

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Alpine

Oct 16, 2019
Unscored —

CVE-2020-13249

libmariadb/mariadb_lib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an OK packet rec…

mariadb-10.3 mariadb-10.1 mariadb-connector-c Ubuntu Alpine

May 20, 2020
Unscored —

CVE-2020-15180

A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for c…

mariadb-10.3 mariadb-10.1 mariadb mariadb-10.5 Debian Ubuntu Alpine

May 27, 2021

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=1764680
report
https://bugzilla.redhat.com/show_bug.cgi?id=1764691
report
https://bugzilla.redhat.com/show_bug.cgi?id=1798587
report
https://bugzilla.redhat.com/show_bug.cgi?id=1830056
report
https://bugzilla.redhat.com/show_bug.cgi?id=1830059
report
https://bugzilla.redhat.com/show_bug.cgi?id=1830060
report
https://bugzilla.redhat.com/show_bug.cgi?id=1830082
report
https://bugzilla.redhat.com/show_bug.cgi?id=1835849
report
https://bugzilla.redhat.com/show_bug.cgi?id=1839827
report
https://bugzilla.redhat.com/show_bug.cgi?id=1890738
report
https://bugzilla.redhat.com/show_bug.cgi?id=1890743
report
https://bugzilla.redhat.com/show_bug.cgi?id=1890747
report
https://bugzilla.redhat.com/show_bug.cgi?id=1890756
report
https://bugzilla.redhat.com/show_bug.cgi?id=1894919
report
https://bugzilla.redhat.com/show_bug.cgi?id=1899009
report
https://bugzilla.redhat.com/show_bug.cgi?id=1899017
report
https://bugzilla.redhat.com/show_bug.cgi?id=1899021
report
https://bugzilla.redhat.com/show_bug.cgi?id=1899082
report
https://bugzilla.redhat.com/show_bug.cgi?id=1899086
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5500.json
report
https://access.redhat.com/security/cve/CVE-2019-2938
advisory
https://www.cve.org/CVERecord?id=CVE-2019-2938
advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-2938
article
http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
report
https://access.redhat.com/security/cve/CVE-2019-2974
advisory
https://www.cve.org/CVERecord?id=CVE-2019-2974
advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-2974
report
https://access.redhat.com/security/cve/CVE-2020-2574
advisory
https://www.cve.org/CVERecord?id=CVE-2020-2574
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-2574
article
https://www.oracle.com/security-alerts/cpujan2020.html
report
https://access.redhat.com/security/cve/CVE-2020-2752
advisory
https://www.cve.org/CVERecord?id=CVE-2020-2752
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-2752
article
https://www.oracle.com/security-alerts/cpuapr2020.html#AppendixMSQL
report
https://access.redhat.com/security/cve/CVE-2020-2760
advisory
https://www.cve.org/CVERecord?id=CVE-2020-2760
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-2760

Red Hat Security Advisory: mariadb:10.3 security, bug fix, and enhancement update

Fixed packages 28

Vulnerabilities 17

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affe…

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affecte…

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affecte…

Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are …

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are …

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affecte…

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Locking). Supported versions that are aff…

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions tha…

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

libmariadb/mariadb_lib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an OK packet rec…

A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for c…

References