The MariaDB project reports :

Details of this vulnerability have not yet been disclosed

This update for mariadb fixes the following issues :

Update to 10.4.17 [bsc#1177472] and [bsc#1178428]

  - fixing for the following security vulnerabilities:
    CVE-2020-14812, CVE-2020-14765, CVE-2020-14776,     CVE-2020-14789, CVE-2020-15180

This update was imported from the SUSE:SLE-15-SP2:Update update project.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5663 advisory.

    MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

    The following packages have been upgraded to a later upstream version: mariadb (10.3.27), galera     (25.3.31). (BZ#1899085, BZ#1899089)

    Security Fix(es):

    * mariadb: Insufficient SST method name check leading to code injection in mysql-wsrep (CVE-2020-15180)

    * mysql: InnoDB unspecified vulnerability (CPU Jan 2019) (CVE-2019-2510)

    * mysql: Server: DDL unspecified vulnerability (CPU Jan 2019) (CVE-2019-2537)

    * mysql: Server: Replication unspecified vulnerability (CPU Apr 2019) (CVE-2019-2614)

    * mysql: Server: Security: Privileges unspecified vulnerability (CPU Apr 2019) (CVE-2019-2627)

    * mysql: InnoDB unspecified vulnerability (CPU Apr 2019) (CVE-2019-2628)

    * mysql: Server: Pluggable Auth unspecified vulnerability (CPU Jul 2019) (CVE-2019-2737)

    * mysql: Server: Security: Privileges unspecified vulnerability (CPU Jul 2019) (CVE-2019-2739)

    * mysql: Server: XML unspecified vulnerability (CPU Jul 2019) (CVE-2019-2740)

    * mysql: InnoDB unspecified vulnerability (CPU Jul 2019) (CVE-2019-2758)

    * mysql: Server: Parser unspecified vulnerability (CPU Jul 2019) (CVE-2019-2805)

    * mysql: InnoDB unspecified vulnerability (CPU Oct 2019) (CVE-2019-2938)

    * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2019) (CVE-2019-2974)

    * mysql: C API unspecified vulnerability (CPU Apr 2020) (CVE-2020-2752)

    * mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2760)

    * mysql: Server: DML unspecified vulnerability (CPU Apr 2020) (CVE-2020-2780)

    * mysql: Server: Stored Procedure unspecified vulnerability (CPU Apr 2020) (CVE-2020-2812)

    * mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2814)

    * mysql: C API unspecified vulnerability (CPU Apr 2020) (CVE-2020-2922)

    * mariadb-connector-c: Improper validation of content in a OK packet received from server (CVE-2020-13249)

    * mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14765)

    * mysql: InnoDB unspecified vulnerability (CPU Oct 2020) (CVE-2020-14776)

    * mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14789)

    * mysql: Server: Locking unspecified vulnerability (CPU Oct 2020) (CVE-2020-14812)

    * mysql: C API unspecified vulnerability (CPU Jan 2020) (CVE-2020-2574)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * FTBFS: -D_GLIBCXX_ASSERTIONS (BZ#1899012)

    * Queries with entity_id IN ('1', '2', , '70000') run much slower in MariaDB 10.3 than on MariaDB 10.1     (BZ#1899020)

    * Cleanup race with wsrep_rsync_sst_tunnel may prevent full galera cluster bootstrap (BZ#1899025)

    * There are undeclared file conflicts in several mariadb and mysql packages (BZ#1899080)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-1477:01 advisory.

    mariadb: Insufficient SST method name check leading to code injection in     mysql-wsrep (CVE-2020-15180)         mysql: InnoDB unspecified vulnerability (CPU Oct 2019) (CVE-2019-2938)         mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2019)     (CVE-2019-2974)         mysql: C API unspecified vulnerability (CPU Apr 2020) (CVE-2020-2752)         mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2760)         mysql: Server: DML unspecified vulnerability (CPU Apr 2020) (CVE-2020-2780)         mysql: Server: Stored Procedure unspecified vulnerability (CPU Apr 2020)     (CVE-2020-2812)         mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2814)         mariadb-connector-c: Improper validation of content in a OK packet received     from server (CVE-2020-13249)         mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14765)         mysql: InnoDB unspecified vulnerability (CPU Oct 2020) (CVE-2020-14776)         mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14789)         mysql: Server: Locking unspecified vulnerability (CPU Oct 2020)     (CVE-2020-14812)         mysql: C API unspecified vulnerability (CPU Jan 2020) (CVE-2020-2574)     CVE(s):
    CVE-2019-2938     Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are     affected are 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability allows high     privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.4 (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
    CVE-2019-2974     Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported     versions that are affected are 5.6.45 and prior, 5.7.27 and prior and 8.0.17 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability     impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
    CVE-2020-2574     Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are     affected are 5.6.46 and prior, 5.7.28 and prior and 8.0.18 and prior. Difficult to exploit vulnerability     allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Client. CVSS 3.0 Base Score 5.9 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).
    CVE-2020-2752     Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are     affected are 5.6.47 and prior, 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability     allows low privileged attacker with network access via multiple protocols to compromise MySQL Client.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Client. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).
    CVE-2020-2760     Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are     affected are 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows high     privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of     MySQL Server accessible data. CVSS 3.0 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).
    CVE-2020-2780     Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions     that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.19 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability     impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
    CVE-2020-2812     Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported     versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.19 and prior. Easily exploitable     vulnerability allows high privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability     impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
    CVE-2020-2814     Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are     affected are 5.6.47 and prior, 5.7.28 and prior and 8.0.18 and prior. Easily exploitable vulnerability     allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
    CVE-2020-13249     libmariadb/mariadb_lib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an     OK packet received from a server. NOTE: although mariadb_lib.c was originally based on code shipped for     MySQL, this issue does not affect any MySQL components supported by Oracle.
    CVE-2020-14765     Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions     that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability     impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
    CVE-2020-14776     Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are     affected are 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high     privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
    CVE-2020-14789     Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions     that are affected are 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high     privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
    CVE-2020-14812     Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Locking). Supported versions     that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior. Easily exploitable     vulnerability allows high privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability     impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
    CVE-2020-15180
    ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when     announcing a new security problem. When the candidate has been publicized, the details for this candidate     will be provided.
    CVE-2021-2022     Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are     affected are 5.6.50 and prior, 5.7.32 and prior and 8.0.22 and prior. Difficult to exploit vulnerability     allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS     Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
    Bug Fix(es):
        FTBFS: -D_GLIBCXX_ASSERTIONS         Queries with entity_id IN ('1', '2', , '70000') run much slower in MariaDB     10.3 than on MariaDB 10.1         Cleanup race with wsrep_rsync_sst_tunnel may prevent full galera cluster     bootstrap         There are undeclared file conflicts in several mariadb and mysql packages     Modularity name: mariadb     Stream name: 10.3

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
141512	FreeBSD : MariaDB -- Undisclosed vulnerability (a2565962-1156-11eb-9c9c-d4c9ef517024)	Nessus	FreeBSD Local Security Checks	2020/10/19	2021/6/14	critical
144321	openSUSE Security Update : mariadb (openSUSE-2020-2254)	Nessus	SuSE Local Security Checks	2020/12/16	2021/6/14	critical
144555	RHEL 8 : mariadb:10.3 (RHSA-2020:5663)	Nessus	Red Hat Local Security Checks	2020/12/22	2024/11/7	critical
294211	MiracleLinux 8 : mariadb:10.3 (AXSA:2021-1477:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/21	critical

检测

插件搜索

critical

critical

critical

critical