Oracle MySQL: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 58

• High 8.0
  CVE-2020-14878

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: LDAP Auth). Supported versions …

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• High 7.5
  CVE-2020-11996 Public exploit EPSS 27%

  Uncontrolled Resource Consumption in Apache Tomcat

  A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 conne…

  Apache Apache Tomcat org.apache.tomcat:tomcat tomcat8 Debian Ubuntu Maven
  Jun 26, 2020
• High 7.5
  CVE-2020-13934 EPSS 64%

  Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat

  An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur…

  org.apache.tomcat:tomcat tomcat8 tomcat9 tomcat9 Debian Ubuntu Maven
  Jul 14, 2020
• High 7.5
  CVE-2020-13935 Public exploit EPSS 87%

  Infinite Loop in Apache Tomcat

  The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payl…

  org.apache.tomcat:tomcat tomcat9 tomcat8 tomcat9 Debian Ubuntu Maven
  Jul 14, 2020
• High 7.5
  CVE-2020-1967 Public exploit EPSS 53%

  Segmentation fault in SSL_check_chain

  Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an i…

  OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine crates.io
  Apr 21, 2020
• High 7.2
  CVE-2020-14828

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affecte…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• High 7.0
  CVE-2020-9484 Public exploit Scanner template EPSS 56%

  Potential remote code execution in Apache Tomcat

  When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManage…

  tomcat9 tomcat8 tomcat9 tomcat7 Debian Ubuntu Maven
  May 20, 2020
• Medium 6.5
  CVE-2020-14765

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affecte…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Debian Ubuntu Alpine
  Oct 21, 2020
• Medium 6.5
  CVE-2020-14769

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 6.5
  CVE-2020-14775

  Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 6.5
  CVE-2020-14800

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 6.5
  CVE-2020-14827

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: LDAP Auth). Supported versions …

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 6.5
  CVE-2020-14830

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 6.5
  CVE-2020-14836

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 6.5
  CVE-2020-14846

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 5.5
  CVE-2020-14760

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 5.3
  CVE-2020-1730

  A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enab…

  Red Hat libssh libssh libssh Debian Ubuntu Alpine
  Apr 13, 2020
• Medium 4.9
  CVE-2020-14672

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions tha…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 4.9
  CVE-2020-14773

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 4.9
  CVE-2020-14776

  Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Debian Ubuntu Alpine
  Oct 21, 2020
• Medium 4.9
  CVE-2020-14777

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 4.9
  CVE-2020-14785

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 4.9
  CVE-2020-14786

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 4.9
  CVE-2020-14789

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affecte…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Debian Ubuntu Alpine
  Oct 21, 2020
• Medium 4.9
  CVE-2020-14790

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 4.9
  CVE-2020-14793

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 4.9
  CVE-2020-14794

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 4.9
  CVE-2020-14799

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 4.9
  CVE-2020-14804

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affecte…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 4.9
  CVE-2020-14809

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 4.9
  CVE-2020-14812

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Locking). Supported versions that are aff…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Debian Ubuntu Alpine
  Oct 21, 2020
• Medium 4.9
  CVE-2020-14814

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affecte…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 4.9
  CVE-2020-14821

  Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 4.9
  CVE-2020-14829

  Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 4.9
  CVE-2020-14837

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 4.9
  CVE-2020-14839

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 4.9
  CVE-2020-14844

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 4.9
  CVE-2020-14845

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 4.9
  CVE-2020-14848

  Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 4.9
  CVE-2020-14852

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Charsets). Supported versions that are af…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 4.9
  CVE-2020-14861

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 4.9
  CVE-2020-14866

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 4.9
  CVE-2020-14868

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 4.9
  CVE-2020-14869

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: LDAP Auth). Supported versions …

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 4.9
  CVE-2020-14870

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: X Plugin). Supported versions that are af…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 4.9
  CVE-2020-14888

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 4.9
  CVE-2020-14891

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 4.9
  CVE-2020-14893

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 4.6
  CVE-2020-14853

  Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: NDBCluster Plugin). Supported versions …

  Oracle MySQL Cluster percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 4.4
  CVE-2020-14867

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affecte…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 4.4
  CVE-2020-14873

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Logging). Supported versions that are aff…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Medium 4.3
  CVE-2020-14838

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Low 3.7
  CVE-2020-11080

  Denial of service in nghttp2

  In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) o…

  nghttp2 nghttp2 nodejs nodejs Debian Ubuntu Alpine
  Jun 3, 2020
• Low 2.7
  CVE-2020-14860

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Roles). Supported versions that…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Low 2.2
  CVE-2020-14771

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: LDAP Auth). Supported versions …

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Low 2.2
  CVE-2020-14791

  Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 21, 2020
• Unscored —
  CVE-2020-8172

  TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.

  nodejs nodejs-current Alpine
  Jun 8, 2020
• Unscored —
  CVE-2020-8174

  napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.

  nodejs nodejs nodejs nodejs-current Debian Ubuntu Alpine
  Jul 24, 2020

Revision history

1. 2026-01-25 #9

   Neue Updates von Dell aufgenommen

2. 2022-03-10 #8

   Neue Updates von Red Hat aufgenommen

3. 2021-10-12 #7

   Neue Updates von Red Hat aufgenommen

4. 2021-09-22 #6

   Neue Updates von Oracle Linux aufgenommen

5. 2021-09-20 #5

   Neue Updates von Red Hat aufgenommen

6. 2021-05-25 #4

   Neue Updates von Gentoo aufgenommen

7. 2021-01-31 #3

   Neue Updates von Debian aufgenommen

8. 2020-12-17 #2

   Neue Updates von Oracle Linux aufgenommen

9. 2020-10-20 #1

   Initiale Fassung

References

• Oracle Critical Patch Update Advisory - October 2020 - Appendix Oracle MySQL vom 2020-10-20
  https://www.oracle.com/security-alerts/cpuoct2020.html#AppendixMSQL
• Oracle Linux Security Advisory ELSA-2020-5500 vom 2020-12-18
  https://linux.oracle.com/errata/ELSA-2020-5500.html
• Debian Security Advisory DLA-2538 vom 2021-01-31
  https://lists.debian.org/debian-lts-announce/2021/01/msg00027.html
• Gentoo Linux Security Advisory GLSA-202105-27 vom 2021-05-26
  https://security.gentoo.org/glsa/202105-27
• Red Hat Security Advisory RHSA-2021:3590 vom 2021-09-21
  https://access.redhat.com/errata/RHSA-2021:3590
• Oracle Linux Security Advisory ELSA-2021-3590 vom 2021-09-23
  http://linux.oracle.com/errata/ELSA-2021-3590.html
• Red Hat Security Advisory RHSA-2021:3811 vom 2021-10-12
  https://access.redhat.com/errata/RHSA-2021:3811
• Red Hat Security Advisory RHSA-2022:0056 vom 2022-03-10
  https://access.redhat.com/errata/RHSA-2022:0056
• Deell Security Update
  https://www.dell.com/support/kbdoc/en-us/000281732/dsa-2025-075-security-update-for-dell-data-protection-advisor-for-multiple-component-vulnerabilities