The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-3732 advisory.

    mysql     [8.0.21-1]
    - Rebase to 8.0.21
    - Use bundled libzstd and libevent for RHSCL and RHEL-8.0.0
    - Check that we have correct versions in bundled(*) Provides
    - Remove re2 bundled dependency

    [8.0.20-1]
    - Rebase to 8.0.20

    [8.0.19-2]
    - Specify all perl dependencies

    [8.0.19-1]
    - Rebase to 8.0.19

    [8.0.18-1]
    - Rebase to 8.0.18
    - Add libzstd-devel dependencies
    - Include patch to build against protobuf 3.11

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MySQL running on the remote host is 5.7.x prior to 5.7.29. It is, therefore, affected by multiple vulnerabilities, including three of the top vulnerabilities below, as noted in the January 2020 Critical Patch Update advisory:

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Compiling (cURL)). Supported   versions that are affected are 5.7.28 and prior and 8.0.18 and prior. Easily exploitable vulnerability allows   unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful   attacks of this vulnerability can result in takeover of MySQL Server (CVE-2019-5482).

  - Unspecified vulnerability in the optimizer component of Oracle MySQL Server. An authenticated, remote attacker   could exploit this issue, to compromise the availability of the application (CVE-2020-2579).

  - Unspecified vulnerabilities in the InnoDB component of Oracle MySQL Server. An authenticated, remote attacker   could exploit these issues, to compromise the availability of the application (CVE-2020-2577, CVE-2020-2589).

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
140614	Oracle Linux 8 : mysql:8.0 (ELSA-2020-3732)	Nessus	Oracle Linux Local Security Checks	2020/9/17	2024/7/9	high
132957	MySQL 5.7.x < 5.7.29 Multiple Vulnerabilities (Jan 2020 CPU)	Nessus	Databases	2020/1/16	2022/10/21	critical

检测

插件搜索

high

critical