CVE-2019-2969

Description

Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS 3.0 Base Score 6.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Affected products

Vendor	Product	Affected	Fixed
Oracle	MySQL Server	5.6.44 and prior, 5.7.26 and prior, 8.0.16 and prior	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 20.04 LTS	mysql-8.0	8.0.18-0ubuntu3	—
Ubuntu 18.04 LTS	mysql-5.7	5.7.28-0ubuntu0.18.04.4	USN-4195-1
Ubuntu 16.04 LTS	mysql-5.7	5.7.28-0ubuntu0.16.04.2	USN-4195-1
Ubuntu 16.04 LTS	percona-server-5.6 +1	No fix yet	—
Ubuntu 14.04 LTS	mysql-5.5	No fix yet	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 8	mecab	0.996-1.module+el8.0.0+3898+e09bb8de.9	RHSA-2019:2511
RHEL 8	mecab-ipadic +1	2.7.0.20070801-16.module+el8.0.0+3898+e09bb8de	RHSA-2019:2511
RHEL 8	mysql +6	8.0.17-3.module+el8.0.0+3898+e09bb8de	RHSA-2019:2511
RHEL 3	rh-mysql80-mysql +9	8.0.17-1.el7	RHSA-2019:2484

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 8	mecab	0.996-1.module_el8.4.0+2532+b8928c02.9	ALSA-2019:2511
AlmaLinux 8	mecab-ipadic +1	2.7.0.20070801-16.module_el8.4.0+2532+b8928c02	ALSA-2019:2511

Rocky Linux