CVE-2019-2797

Description

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). Supported versions that are affected are 5.7.26 and prior and 8.0.16 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.2 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

Affected products

Vendor	Product	Affected	Fixed
Oracle	MySQL Server	5.7.26 and prior, 8.0.16 and prior	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 18.04 LTS	mysql-5.7	5.7.27-0ubuntu0.18.04.1	USN-4070-1
Ubuntu 16.04 LTS	mysql-5.7	5.7.27-0ubuntu0.16.04.1	USN-4070-1
Ubuntu 16.04 LTS	percona-server-5.6 +1	No fix yet	—
Ubuntu 14.04 LTS	mysql-5.5	No fix yet	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 8	mecab	0.996-1.module+el8.0.0+3898+e09bb8de.9	RHSA-2019:2511
RHEL 8	mecab-ipadic +1	2.7.0.20070801-16.module+el8.0.0+3898+e09bb8de	RHSA-2019:2511
RHEL 8	mysql +6	8.0.17-3.module+el8.0.0+3898+e09bb8de	RHSA-2019:2511
RHEL 3	rh-mysql80-mysql +9	8.0.17-1.el7	RHSA-2019:2484

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 8	mecab	0.996-1.module_el8.4.0+2532+b8928c02.9	ALSA-2019:2511
AlmaLinux 8	mecab-ipadic +1	2.7.0.20070801-16.module_el8.4.0+2532+b8928c02	ALSA-2019:2511

Rocky Linux