Red Hat Security Advisory

RHSA-2020:5663

mariadb:10.3 security, bug fix, and enhancement update

Released 2020-12-22 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream E4S (v. 8.0) Judy-1.0.5-18.module+el8+2765+cfa4f87b.ppc64le::mariadb:10.3, Judy-1.0.5-18.module+el8+2765+cfa4f87b.src::mariadb:10.3, Judy-1.0.5-18.module+el8+2765+cfa4f87b.x86_64::mariadb:10.3 +30

Fixes 29 records

TI-2020-11952 CVE-2020-15180

Improper input validation in mariadb

MEDIUM 47

A flaw was found in the mysql-wsrep component of mariadb.

CVSS 3.1CRITICAL 9.0 Network No auth No interaction EPSS 0.05539 Published 2021-05-27 Partial fix CWE-20

TI-2020-10378 CVE-2020-13249 · GHSA-44c7-hc99-224f

libmariadb/mariadb_lib.c in MariaDB Connector/C before 3.1.8 does not properly validate…

MEDIUM 43

libmariadb/mariadb_lib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an OK packet received from a server.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.02396 Published 2020-05-20 Fixed

TI-2021-01824 CVE-2021-2144 · GHSA-m8h9-m594-xwrv

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser).

LOW 37

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser).

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01886 Published 2021-04-22 Partial fix

TI-2019-02281 CVE-2019-2740 · GHSA-568g-c3m2-wvj8

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: XML).

LOW 36

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: XML).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.04005 Published 2019-07-23 Partial fix

TI-2020-11600 CVE-2020-14765 · GHSA-386x-hp87-5862

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS).

LOW 35

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.03173 Published 2020-10-21 Partial fix

TI-2019-02499 CVE-2019-2974 · GHSA-p396-jmwr-p8q2

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).

LOW 35

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.03756 Published 2019-10-16 Partial fix

TI-2019-02346 CVE-2019-2805 · GHSA-mg8g-w6cx-6qq2

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 35

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.03699 Published 2019-07-23 Partial fix

TI-2020-02481 CVE-2020-2780 · GHSA-4vxw-fr2r-cwgh

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).

LOW 34

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0245 Published 2020-04-15 Partial fix

TI-2020-02277 CVE-2020-2574 · GHSA-33hv-cjr4-37wm

Vulnerability in the MySQL Client product of Oracle MySQL (component: C API).

LOW 33

Vulnerability in the MySQL Client product of Oracle MySQL (component: C API).

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.03514 Published 2020-01-15 Partial fix

TI-2020-02461 CVE-2020-2760 · GHSA-24wg-pxg5-46cj

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

LOW 30

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.03014 Published 2020-04-15 Partial fix

TI-2019-02299 CVE-2019-2758 · GHSA-3f7w-jxww-c39p

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB).

LOW 30

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB).

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.03061 Published 2019-07-23 Partial fix

TI-2019-02092 CVE-2019-2537 · GHSA-cxvc-c563-9w9g

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL).

LOW 30

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.04266 Published 2019-01-16 Partial fix

TI-2020-02453 CVE-2020-2752 · GHSA-vcxq-55mq-gj87

Vulnerability in the MySQL Client product of Oracle MySQL (component: C API).

LOW 29

Vulnerability in the MySQL Client product of Oracle MySQL (component: C API).

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.02336 Published 2020-04-15 Partial fix

TI-2019-02278 CVE-2019-2737 · GHSA-pfwc-xjhv-c45m

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 29

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Pluggable Auth).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.03951 Published 2019-07-23 Partial fix

TI-2019-02067 CVE-2019-2510 · GHSA-g2qv-pxr5-f3q6

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB).

LOW 29

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.03443 Published 2019-01-16 Partial fix

TI-2020-11647 CVE-2020-14812 · GHSA-9q26-4qw9-g46v

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Locking).

LOW 28

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Locking).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.02915 Published 2020-10-21 Partial fix

TI-2020-02513 CVE-2020-2814 · GHSA-55fq-93v7-cmq6

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

LOW 28

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.02805 Published 2020-04-15 Partial fix

TI-2020-02511 CVE-2020-2812 · GHSA-3r87-7296-4j6w

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored…

LOW 28

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.03006 Published 2020-04-15 Partial fix

TI-2019-02178 CVE-2019-2628 · GHSA-gcp9-442f-6h5p

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB).

LOW 28

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.02799 Published 2019-04-23 Partial fix

TI-2019-02177 CVE-2019-2627 · GHSA-p87x-pph3-ghm8

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 28

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.0298 Published 2019-04-23 Partial fix

TI-2021-01870 CVE-2021-2194 · GHSA-3rv3-73vp-853w

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

LOW 27

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.02308 Published 2021-04-22 Partial fix

TI-2020-11624 CVE-2020-14789 · GHSA-r9xf-mwcp-f4x8

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS).

LOW 27

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.02653 Published 2020-10-21 Partial fix

TI-2020-11611 CVE-2020-14776 · GHSA-wwww-3wrv-3qjj

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

LOW 27

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.02653 Published 2020-10-21 Partial fix

TI-2019-02463 CVE-2019-2938 · GHSA-w6f4-2gqx-qg89

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

LOW 26

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.02985 Published 2019-10-16 Partial fix

TI-2019-02164 CVE-2019-2614 · GHSA-86qm-m5x9-pxr7

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 26

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication).

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.02782 Published 2019-04-23 Partial fix

TI-2019-02280 CVE-2019-2739 · GHSA-f472-q7mx-rx6p

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 25

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges).

CVSS 3.1MEDIUM 5.1 Local High privileges No interaction EPSS 0.00796 Published 2019-07-23 Partial fix

TI-2021-01708 CVE-2021-2022 · GHSA-vmp3-cr49-pjf6

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

LOW 24

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.0192 Published 2021-01-20 Partial fix

TI-2021-01693 CVE-2021-2007 · GHSA-62m3-j4w3-p5mw

Vulnerability in the MySQL Client product of Oracle MySQL (component: C API).

LOW 22

Vulnerability in the MySQL Client product of Oracle MySQL (component: C API).

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.02308 Published 2021-01-20 Partial fix

TI-2020-02617 CVE-2020-2922 · GHSA-95hr-j7p7-26x4

Vulnerability in the MySQL Client product of Oracle MySQL (component: C API).

LOW 22

Vulnerability in the MySQL Client product of Oracle MySQL (component: C API).

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.02518 Published 2020-04-15 Partial fix